1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
# Weekly BP Report Operations Log -- 2026-08-23
## 2026-08-23 02:31:00 -- Phase 0: Initialize
- ASNs configured: 25
- Run dir: ~/Documents/gists/kevlar/2026-08-23/ (sponge/, honeylabs/, censys/, changes/, iocs/ created)
- Censys credits: 10,000 remaining (reset 2026-09-13). Per-IP enrichment: ENABLED
- Prior baseline: 2026-08-17 run found (full data set present)
- Errors: none
## 2026-08-24 02:44:00 -- Phase 1: Sponge Data Gathering
- ASNs queried: 25 (session_stats ip/port per ASN; tag aggregation returns 0 rows in Sponge for all ASNs -- skipped, consistent with prior runs)
- Timeline: full all-ASN hourly (split_size capped) + daily top-40 window 08-10..08-24
- Weekly totals cached: weekly-totals-by-asn.ndjson (17 of 25 ASNs active this week)
- API calls: ~75 session_stats/timeline; Results cached: Y
- Data range confirmed: 2026-03-12 .. 2026-08-24
- Errors: none
## 2026-08-24 02:46:00 -- Phase 2: Honeylabs (in progress)
- Window: 2026-08-17T00:00:00Z .. 2026-08-24T00:00:00Z
- AS51396: 100-event sample cached; top-attackers by IP captured
- Errors: none
## 2026-08-24 03:00:00 -- Phase 3: Censys Infrastructure Profiling
- Aggregations: 11 ASNs x (port, software, labels, cert issuer, OS); cached to censys/aggregations-AS*.ndjson
- Per-IP enrichment: 10 hosts (get_host / get_host_services); cached to censys/ip-enrichments.ndjson
- Fleet correlation: 8 linkage findings; censys/fleet-correlation.csv
- Credits used this phase: ~60 of 10,000
- Errors: none
## 2026-08-24 03:02:00 -- Phase 4: Change Detection
- Baseline: 2026-08-17 run
- Diffs computed per ASN: new/gone IPs, new/gone ports, session volume delta
- Output: changes/diff-vs-prior-week.csv, changes/anomalies.csv (14 flags)
- Notable: PLI-AS +341%, FLOKINET +351%, AUROLOGIC +5380%, KPRONET +146%, PROSPERO +900%; HOSTKEY -93%, AEZA -91%
- Errors: none
## 2026-08-24 03:06:00 -- Phase 5: Narrative and Build
- Blog post: src/data/blog/2026-08-23-weekly-bulletproof-report.md (ai.rud.is)
- Build: npm run build -> exit 0, 0 errors, post rendered
- Errors: none
## 2026-08-24 03:07:00 -- Phase 6: IoC Archival
- iocs/all-observed-ips.txt (151 lines), iocs/fingerprints.txt (19), iocs/c2-paths.txt (39), iocs/README.md
- Web mirror: https://git.sr.ht/~hrbrmstr/gists/tree/main/item/kevlar/2026-08-23/
- Errors: none
RUN COMPLETE
|
