1 files changed, 40 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json b/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json
new file mode 100644
index 0000000..66d5ab5
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/ioc-179.43.167.2.json
@@ -0,0 +1,40 @@
+{
+ "total_events": 71,
+ "first_seen": "2026-08-29T20:36:09",
+ "last_seen": "2026-08-30T12:11:49",
+ "asn_number": 51852,
+ "asn_org": "Private Layer INC",
+ "country_name": "Switzerland",
+ "country_code": "CH",
+ "ports_targeted": [
+  5060
+ ],
+ "ports_targeted_count": 1,
+ "tls_event_count": 0,
+ "top_http_methods": [],
+ "top_user_agents": [],
+ "top_url_paths": [],
+ "top_ja4_fingerprints": [],
+ "top_ja3_fingerprints": [],
+ "top_hassh_fingerprints": [],
+ "client_cert_event_count": 0,
+ "client_cert_subjects": [],
+ "rdns": "hostedby.privatelayer.com",
+ "loader_hits": 0,
+ "exploit_hits": 0,
+ "bytes_sent": 75899,
+ "unique_source_ips": 1,
+ "ioc": "179.43.167.2",
+ "window": "all retained data (no time filter)",
+ "query_type": "ip",
+ "scanner": null,
+ "verdict_key": "probing",
+ "verdict": "Low-level probing",
+ "verdict_why": [
+  "71 event(s), fewer than 10 distinct ports, no exploit payloads.",
+  "Not in any known-scanner range.",
+  "Sent 75,899 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."
+ ],
+ "verdict_confidence": "low",
+ "cve_probes": []
+}
+\ No newline at end of file