1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
# Weekly BP Report Operations Log — 2026-09-07
## 2026-09-07 09:39 UTC — Phase 0: Initialize
- ASNs loaded: 25 (bulletproof-asns.csv)
- Run dir created: ~/Documents/gists/kevlar/2026-09-07/{sponge,honeylabs,censys,changes,iocs}
- Censys credits: 10,000 (resets 2026-09-13) — above 500, per-IP enrichment enabled
- Prior baseline: 2026-08-31
## 2026-09-07 09:40 UTC — Phase 1: Sponge (Arkime)
- Connectivity: OK. Data range 2026-03-12 → 2026-09-07 (180 days), 10k+ sessions/day
- 1b: 50 session_stats calls (25 ASNs × source.ip + destination.port), window 2026-08-31→2026-09-07
- 1c: multi-ASN 1h timeline, 840 rows (top-5 ASNs by split, default split_size)
- Active ASNs (sessions): KAOPU-HK 138915 (10k+ cap), PFCLOUD 51396 (10k+ cap), PROTON66 198953 (1469), ROUTERHOSTING 14956 (277), ZHOUYISAT 400992 (226), HOSTKEY 57043 (196), AEZA 210644 (97), PLI 51852 (97), FLOKINET 200651 (76), INVISIONTECH 216309 (60), KPRONET 214940 (59), Datashield 211720 (20), THE 209847 (3), AUROLOGIC 30823 (2), PROSPERO 200593 (1)
- Zero-session ASNs: IRONHOST, UFO, QWINS, RU-AEZA, ADPL, FEMOIT, MEDIALAND, KAOPY, TR-ARKEL, KORGRID
- Cached: 50 stats files + timeline-all-asns.ndjson + data-range-1d.ndjson
- API calls: 53; Errors: none
## 2026-09-07 09:5x UTC — Phase 2: Honeylabs
- Window: 2026-08-31 → 2026-09-07. 750ms pacing, sequential per ASN.
- top_attackers(by=ip/user_agent) × 25 ASNs = 50 calls; search_events × 25 (6 needed artifact re-reads for large payloads); ioc_lookup × 18 top IPs (days=7); asn_enrich × 6
- Notable: PFCLOUD 8,500 events/49 IPs; PROTON66 1,669/4; ROUTERHOSTING 95/12; AEZA 51/1 (exploit attempts, 185.246.217.150); PLI 32/5 (exploit attempts, 179.43.150.26); HOSTKEY 12/2
- Zero-activity ASNs in Honeylabs: THE, KAOPU-HK, IRONHOST, ZHOUYISAT, UFO, QWINS, AUROLOGIC, ADPL, FEMOIT, PROSPERO, KPRONET, MEDIALAND, Datashield, INVISIONTECH, KAOPY, TR-ARKEL, KORGRID; RU-AEZA 2 events
- Cached: events-AS*.ndjson, top-attackers-*.json, ioc-lookups.json, asn-enrichments.json, top-attackers.csv (47 rows), fingerprints.csv (36 IPs)
- Errors: 6 search_events inline-parse failures recovered via artifact:// re-read; no rate-limit hits
## 2026-09-07 10:0x UTC — Phase 3: Censys
- Credits at start: 10,000
- 3b: 125 aggregate calls (25 ASNs × 5 fields), 400ms pacing, zero errors
- 3c: 20 calls (get_host + get_host_services × top 10 Honeylabs IPs)
- 3d: fleet correlation — PFCLOUD cloned /29 (204.76.203.213/221/222, OpenSSH 8.9p1 Ubuntu-3ubuntu0.17); ROUTERHOSTING Windows RDP fleet; PROTON66 RDP node 176.120.22.61; FLOKINET Tor exit 185.100.87.136 (SSH 7288); 9/10 enriched IPs carry Censys BULLETPROOF label
- Cached: aggregations-AS*.ndjson × 25, ip-enrichments.ndjson, enrichment-summary.json, fleet-correlation.csv
## 2026-09-07 10:0x UTC — Phase 4: Change detection
- Baseline 2026-08-31. Discovery: prior run's Sponge stats cached UNBOUNDED windows (spot check: HOSTKEY prior-week windowed=6 vs cached 1990) — raw deltas were artifacts.
- Re-queried prior week (2026-08-24→31) for all 25 ASNs × 2 fields (50 calls) for matched-window diff; cached changes/prior-window-2026-08-24_31.json
- Matched-window findings: PFCLOUD 2.5x spike (34,932→87,938); HOSTKEY 6→196; AEZA collapse 80,345→97; INVISIONTECH new (0→26); ROUTERHOSTING -85%; PLI -87%; THE -93%
- Censys prior-file format (nested result.result, no top-level total) initially parsed empty; re-parsed correctly. ADPL +3,757 visible hosts; KAOPU -1,246
- Notable new cert issuers: Hydra Authentication RSA SubCA (PLI = HydraPanel), AnyDesk Client (ROUTERHOSTING, PROSPERO), USDTCDN (ADPL), Cloudbase-Init WinRM (PFCLOUD)
- Cached: diff-vs-prior-week.csv (25 rows), anomalies.csv (47 rows), censys-software-changes.csv
## 2026-09-07 10:1x UTC — Phase 1d: BP IP session searches
- 12 top IPs searched in Sponge (window 08-31→09-07, size=5)
- Corroborated in Sponge: PROTON66 .61, PFCLOUD .4/.222, FLOKINET .136, PLI .26, ZHOUYISAT .87, KAOPU .209, KPRONET .94, THE .2
- Not in Sponge: AEZA 185.246.217.150, ROUTERHOSTING 45.61.157.82 / 144.172.108.79 (Honeylabs-only)
- Cached: sponge/bp-ip-sessions.csv
## 2026-09-07 10:2x UTC — Phase 5: Blog post
- Draft written under technical-prose skill; banned-phrase scan clean (domain terms only); style-editing (Williams) pass applied: 4 over-length sentences split, 2 -ing verbs removed, unverified claim dropped
- Fact corrections after verification pass: 37 eval-stdin paths (was 9), 3 /eventmanager hits (was 4), JA4H ge11nn0400 attribution ROUTERHOSTING/PLI/PFCLOUD (was AEZA)
- Build: npm run build PASS, 0 errors 0 warnings, post at /posts/2026-09-07-weekly-bulletproof-report/
## 2026-09-07 10:2x UTC — Phase 6: IoC archival
- all-observed-ips.txt: 135 unique IPs grouped by ASN (sponge + honeylabs merged)
- fingerprints.txt: 9 JA4, 17 JA4H, 2 HASSH with IP attribution
- c2-paths.txt: top 40 of 75 observed paths
- README.md: run summary
- Run complete
|
