From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json | 56 +++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json (limited to 'kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json') diff --git a/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json b/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json new file mode 100644 index 0000000..3b57abc --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-154.90.37.55.json @@ -0,0 +1,56 @@ +{ + "total_events": 7, + "first_seen": "2026-07-22T10:02:16", + "last_seen": "2026-08-27T07:59:32", + "asn_number": 138915, + "asn_org": "Kaopu Cloud HK Limited", + "country_name": "Philippines", + "country_code": "PH", + "ports_targeted": [ + 1190, + 5986, + 6666, + 11111, + 9092, + 9030 + ], + "ports_targeted_count": 6, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Microsoft WinRM Client" + ], + "top_url_paths": [ + "/wsman?PSVersion=5.1.19041.1" + ], + "top_ja4_fingerprints": [ + "t13i220900_231e334592e8_29829a46703f" + ], + "top_ja3_fingerprints": [ + "622a7fd6adbafa3736c1a3468db8a8e0" + ], + "top_hassh_fingerprints": [ + "eb0e0554de9aeb368191c86016a40080" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1124, + "unique_source_ips": 1, + "ioc": "154.90.37.55", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "7 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +} \ No newline at end of file -- cgit v1.2.3