diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-31 07:56:38 -0400 |
| commit | e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d (patch) | |
| tree | e02486c0af8f5f8bf64600f0a1a2b4904c4c123a /kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json | |
| parent | 1d9b78adfc083d1120c55e403e6b3d6317a1171f (diff) | |
add: bph report iocs
Diffstat (limited to 'kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json')
| -rw-r--r-- | kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json new file mode 100644 index 0000000..2fe467f --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:154.90.37.55.json @@ -0,0 +1,56 @@ +{ + "total_events": 7, + "first_seen": "2026-07-22T10:02:16", + "last_seen": "2026-08-27T07:59:32", + "asn_number": 138915, + "asn_org": "Kaopu Cloud HK Limited", + "country_name": "Philippines", + "country_code": "PH", + "ports_targeted": [ + 1190, + 5986, + 6666, + 11111, + 9092, + 9030 + ], + "ports_targeted_count": 6, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Microsoft WinRM Client" + ], + "top_url_paths": [ + "/wsman?PSVersion=5.1.19041.1" + ], + "top_ja4_fingerprints": [ + "t13i220900_231e334592e8_29829a46703f" + ], + "top_ja3_fingerprints": [ + "622a7fd6adbafa3736c1a3468db8a8e0" + ], + "top_hassh_fingerprints": [ + "eb0e0554de9aeb368191c86016a40080" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1124, + "unique_source_ips": 1, + "ioc": "::ffff:154.90.37.55", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "7 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +}
\ No newline at end of file |