add: bph report iocs

1 files changed, 69 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json b/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json
new file mode 100644
index 0000000..1ebcb34
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/ioc-185.100.87.136.json
@@ -0,0 +1,69 @@
+{
+ "total_events": 365,
+ "first_seen": "2026-02-16T21:48:36",
+ "last_seen": "2026-08-31T06:06:56",
+ "asn_number": 200651,
+ "asn_org": "FlokiNET ehf",
+ "country_name": "Romania",
+ "country_code": "RO",
+ "ports_targeted": [
+  443,
+  80,
+  8080,
+  444,
+  2222,
+  22,
+  8443
+ ],
+ "ports_targeted_count": 7,
+ "tls_event_count": 97,
+ "top_http_methods": [
+  "GET",
+  "POST"
+ ],
+ "top_user_agents": [
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2",
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0",
+  "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0",
+  "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"
+ ],
+ "top_url_paths": [
+  "/",
+  "/images/transparentpix.gif",
+  "/eventmanager",
+  "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows",
+  "/ajax",
+  "/api/checkin",
+  "/api/v1/update",
+  "/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7"
+ ],
+ "top_ja4_fingerprints": [
+  "t13i1909h2_9dc949149365_97f8aa674fd9"
+ ],
+ "top_ja3_fingerprints": [
+  "7c1e207beb00684bbbe144f1b0abe1d5"
+ ],
+ "top_hassh_fingerprints": [
+  "e54ef3ec27fe1fea7ab64d3fa05359fd"
+ ],
+ "client_cert_event_count": 0,
+ "client_cert_subjects": [],
+ "rdns": "",
+ "loader_hits": 0,
+ "exploit_hits": 0,
+ "bytes_sent": 38825,
+ "unique_source_ips": 1,
+ "ioc": "185.100.87.136",
+ "window": "all retained data (no time filter)",
+ "query_type": "ip",
+ "scanner": null,
+ "verdict_key": "probing",
+ "verdict": "Low-level probing",
+ "verdict_why": [
+  "365 event(s), fewer than 10 distinct ports, no exploit payloads.",
+  "Not in any known-scanner range.",
+  "Sent 38,825 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."
+ ],
+ "verdict_confidence": "low",
+ "cve_probes": []
+}
\ No newline at end of file