1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
# Weekly BP Report -- 2026-08-31
Generated: 2026-08-31T10:40:00Z
Baseline: 2026-08-23
Note: deception honeypot fleet reconfigured 2026-08-28; fleet reports (28-31 Aug) attached to run. Fleet data used for attack/IoC enrichment only.
## 2026-08-31 11:15:00 -- Phase 1: Sponge (Arkime)
- ASNs queried: 25
- API calls: 1 timeline + 50 stats (2/ASN) + 1 split timeline + 9 session searches
- Results cached: 52 files sponge/
- Errors: none
## 2026-08-31 11:20:00 -- Phase 2: Honeylabs
- ASNs queried: 25 (3 calls/ASN + per-day events pagination + IOC drilldowns)
- API calls: ~190
- Results cached: events-*.ndjson (9 ASNs with data, 492 sampled events), top-attackers.csv, fingerprints.csv, observed-ips.json, summary.json, ioc-*.json
- Errors: initial passes hit MCP bridge truncation on large responses; fixed via per-day limit=20 + rawContent extraction. Final pass 0 errors.
- Note: ioc_lookup does not support ASN strings (returns 0); used top_attackers(asn) + per-IP IOC drilldown instead.
## 2026-08-31 11:37:00 -- Phase 1d: BP IP session searches
- 9 IPs searched, caches in sponge/ip-sessions/
- Cross-corroboration: 204.76.203.7 (PFCLOUD), 176.120.22.61 (PROTON66), 185.100.87.136 (FLOKINET), 147.45.71.214 (AEZA) all present in Arkime at scale
## 2026-08-31 11:55:00 -- Phase 3: Censys
- 25 ASNs aggregated x5 fields (125 calls) + 10 IP enrichments (get_host + get_host_services)
- Cached: censys/aggregations-*.ndjson, aggregations-all.json, ip-enrichments.ndjson, fleet-correlation.csv
- Key: all 25 ASNs carry BULLETPROOF label; KPRONET zero visible services (scan-only profile)
- Errors: 1 truncated host lookup (204.76.203.49) retried OK
## 2026-08-31 12:00:00 -- Phase 4: Change detection
- Baseline 2026-08-23. SPONGE FLEET RECONFIGURED 2026-08-28: prior-week Arkime volumes are NOT comparable (sensor coverage change). Deltas recorded but flagged as baseline break; this run becomes the new baseline.
- Cached: changes/diff-vs-prior-week.csv, changes/anomalies.csv (50 rows, volume+churn+fingerprints)
## 2026-08-31 12:30:00 -- Phase 5+6: Report and archival
- Blog post: ai.rud.is/src/data/blog/2026-08-31-weekly-bulletproof-report.md (build passed, 32.8s)
- IoCs: 416 unique IPs, fingerprints, paths, README cached in iocs/
- Run complete
|
