add: bph report iocs

1 files changed, 89 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json b/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json
new file mode 100644
index 0000000..5f1be66
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/ioc-::ffff:176.120.22.61.json
@@ -0,0 +1,89 @@
+{
+ "total_events": 9934,
+ "first_seen": "2026-03-10T13:01:04",
+ "last_seen": "2026-08-31T09:44:38",
+ "asn_number": 198953,
+ "asn_org": "Proton66 OOO",
+ "country_name": "Russia",
+ "country_code": "RU",
+ "ports_targeted": [
+  1435,
+  1433,
+  1434,
+  3433,
+  11433,
+  3005,
+  14333,
+  1800,
+  5005,
+  14330,
+  8433,
+  2433,
+  1533,
+  8888,
+  18433,
+  1437,
+  23341,
+  33000,
+  7433,
+  1455,
+  4171,
+  21433,
+  6240,
+  25366,
+  61433,
+  9999,
+  41433,
+  6802,
+  2468,
+  12433,
+  10433,
+  42130,
+  5000,
+  5367,
+  43399,
+  1444,
+  3333,
+  6433,
+  6366,
+  51433,
+  1551,
+  3341,
+  6602,
+  17433,
+  22020,
+  9433,
+  14331,
+  1002,
+  1501,
+  45366
+ ],
+ "ports_targeted_count": 289,
+ "tls_event_count": 0,
+ "top_http_methods": [],
+ "top_user_agents": [],
+ "top_url_paths": [],
+ "top_ja4_fingerprints": [],
+ "top_ja3_fingerprints": [],
+ "top_hassh_fingerprints": [],
+ "client_cert_event_count": 0,
+ "client_cert_subjects": [],
+ "rdns": "",
+ "loader_hits": 0,
+ "exploit_hits": 0,
+ "bytes_sent": 476678,
+ "unique_source_ips": 1,
+ "ioc": "::ffff:176.120.22.61",
+ "window": "all retained data (no time filter)",
+ "query_type": "ip",
+ "scanner": null,
+ "verdict_key": "scanning",
+ "verdict": "Unrecognized scanner",
+ "verdict_why": [
+  "No exploit payloads observed.",
+  "Swept 289 distinct ports (threshold for a sweep is 10).",
+  "Not in any known-scanner range."
+ ],
+ "verdict_confidence": "medium",
+ "cve_probes": []
+}
\ No newline at end of file