From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../2026-08-31/honeylabs/ioc-194.48.142.134.json | 39 ++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json (limited to 'kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json') diff --git a/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json b/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json new file mode 100644 index 0000000..cdbcf83 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/ioc-194.48.142.134.json @@ -0,0 +1,39 @@ +{ + "total_events": 1, + "first_seen": "2026-08-30T15:38:28", + "last_seen": "2026-08-30T15:38:28", + "asn_number": 400992, + "asn_org": "ZhouyiSat Communications", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 25565 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 22, + "unique_source_ips": 1, + "ioc": "194.48.142.134", + "window": "all retained data (no time filter)", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] +} \ No newline at end of file -- cgit v1.2.3