add: bph report iocs

1 files changed, 64 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json b/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json
new file mode 100644
index 0000000..917b28b
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/ioc-147.45.71.214.json
@@ -0,0 +1,64 @@
+{
+ "total_events": 36,
+ "first_seen": "2026-08-28T20:14:49",
+ "last_seen": "2026-08-29T08:27:41",
+ "asn_number": 210644,
+ "asn_org": "Aeza Group LLC",
+ "country_name": "Austria",
+ "country_code": "AT",
+ "ports_targeted": [
+  8080,
+  8090,
+  8081,
+  8085,
+  8999,
+  8989,
+  8282
+ ],
+ "ports_targeted_count": 7,
+ "tls_event_count": 25,
+ "top_http_methods": [
+  "GET"
+ ],
+ "top_user_agents": [
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",
+  "Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/616.19.3 (KHTML, like Gecko) Version/17.6.11 Safari/616.19.3",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.18",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.5.18"
+ ],
+ "top_url_paths": [
+  "/",
+  "/favicon.ico",
+  "/v1/getinfo"
+ ],
+ "top_ja4_fingerprints": [
+  "t12i130500_2d7513195f68_e51b7354d87f",
+  "t13i1909h2_9dc949149365_97f8aa674fd9"
+ ],
+ "top_ja3_fingerprints": [
+  "cba7f34191ef2379c1325641f6c6c4f4",
+  "7c1e207beb00684bbbe144f1b0abe1d5"
+ ],
+ "top_hassh_fingerprints": [],
+ "client_cert_event_count": 0,
+ "client_cert_subjects": [],
+ "rdns": "",
+ "loader_hits": 0,
+ "exploit_hits": 0,
+ "bytes_sent": 8107,
+ "unique_source_ips": 1,
+ "ioc": "147.45.71.214",
+ "window": "all retained data (no time filter)",
+ "query_type": "ip",
+ "scanner": null,
+ "verdict_key": "probing",
+ "verdict": "Low-level probing",
+ "verdict_why": [
+  "36 event(s), fewer than 10 distinct ports, no exploit payloads.",
+  "Not in any known-scanner range.",
+  "Sent 8,107 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."
+ ],
+ "verdict_confidence": "low",
+ "cve_probes": []
+}
\ No newline at end of file