diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-24 00:26:19 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-24 00:26:19 -0400 |
| commit | b6f4f2af55e81a459cb126da5ef972b9305cf67d (patch) | |
| tree | f5a6118c4b78948f3de56007de2a83fd3e7fca2b /kevlar/2026-08-23/honeylabs/events-AS200651.json | |
| parent | 9e24d597958ebcd21c40f8cf69e38f134b2d7cb5 (diff) | |
add: bph report iocs and daily drop helper
Diffstat (limited to 'kevlar/2026-08-23/honeylabs/events-AS200651.json')
| -rw-r--r-- | kevlar/2026-08-23/honeylabs/events-AS200651.json | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kevlar/2026-08-23/honeylabs/events-AS200651.json b/kevlar/2026-08-23/honeylabs/events-AS200651.json new file mode 100644 index 0000000..783ffc1 --- /dev/null +++ b/kevlar/2026-08-23/honeylabs/events-AS200651.json @@ -0,0 +1,12 @@ +[ + {"source_ip": "185.100.87.136", "asn": 200651, "asn_org": "FlokiNET ehf", "country_code": "RO", "tor_exit": true, + "window": "2026-08-17..2026-08-24", "event_count": 11, + "behaviors": [ + {"method": "POST", "path": "/api/checkin", "port": 8443, "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "ja4h": "po11nn0500_e4a47a99f1ac", "count": 3, "note": "JSON body 26 bytes, cache-control no-cache"}, + {"method": "GET", "path": "/images/transparentpix.gif", "port": 443, "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", "ja4": "t13i1909h2_9dc949149365_97f8aa674fd9", "ja3": "7c1e207beb00684bbbe144f1b0abe1d5", "ja4h": "ge11nn0400_88d30a62b7ad", "count": 3, "note": "tracking-pixel style beacon over TLS 1.3 ChaCha20"}, + {"method": "GET", "path": "/", "port": 444, "ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0", "count": 1}, + {"method": "raw", "path": "", "port": 443, "payload": "\\u0010 \\u0000\\u0000BBBB...DAAA", "count": 3, "note": "16-byte binary probes, no app protocol"}, + {"method": "raw", "path": "", "port": 443, "payload": "93-byte binary", "count": 1} + ], + "timestamps": {"first": "2026-08-18T07:43:51", "last": "2026-08-23T21:14:50"}} +] |