blob: f870413d4197f3f21e364665b5d56eaae6b39b86 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
# Weekly BP Report -- 2026-08-23
Generated: 2026-08-24T03:05:00Z
ASNs covered: 25
Sponge sessions found: 132,852 (17 ASNs active, window 2026-08-17..2026-08-24)
Honeylabs events found: ~14,000 (13 ASNs with events)
Censys IPs enriched: 10
Anomalies flagged: 14 (see changes/anomalies.csv)
## Key findings
1. AUROLOGIC (AS30823): compromised Windows Server 2016 AD domain controller
`erp01.ad.reiscrew.de` (45.11.18.33) now runs RDP sweeps (`mstshash=hello`, 455 events).
2. FLOKINET beacon host 185.100.87.136 rotated endpoint from `/api/client/update`
(SPARK COMMIT) to `POST /api/checkin`; same TLS fingerprint both weeks.
3. PLI-AS +341%: market-maker bot discovery scanner (mmsk-scout/mm-scout), .env prober,
DCE/RPC scanner; shared HASSH with PFCLOUD clone fleet persists (week 3).
4. PFCLOUD proxy-validation fleet confirmed: azenv.net / httpbin.org CONNECT / socks5 /
proxy.flarevpn.digital judges; GreyNoise flags Ivanti/Pulse/F5/CrushFTP scanning.
5. KAOPU-HK 38.54.2.0/24 port-sprawl farm: ~100 HTTP listeners per host.
6. YE-series Xray panel certs span 6 monitored ASNs; AEZA carries 26k+.
## Sources and errors
- Sponge (Arkime): online, data 2026-03-12..2026-08-24. Tag aggregation returns 0 rows
for all ASNs (known limitation); IP/port aggregations used instead.
- Honeylabs: no rate-limit errors.
- Censys: 10,000 credits at start of run; ~50 aggregate + 10 host lookups used.
- Blog post: /Users/hrbrmstr/projects/ai.rud.is/src/data/blog/2026-08-23-weekly-bulletproof-report.md
(build verified, 0 errors)
|
