From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001
From: hrbrmstr <bob@rud.is>
Date: Mon, 31 Aug 2026 07:56:38 -0400
Subject: add: bph report iocs

---
 kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json | 95 +++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json

(limited to 'kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json')

diff --git a/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json b/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json
new file mode 100644
index 0000000..6789dcf
--- /dev/null
+++ b/kevlar/2026-08-31/honeylabs/ioc-204.76.203.7.json
@@ -0,0 +1,95 @@
+{
+ "total_events": 3000,
+ "first_seen": "2026-08-10T12:50:10",
+ "last_seen": "2026-08-31T11:08:11",
+ "asn_number": 51396,
+ "asn_org": "Pfcloud UG (haftungsbeschrankt)",
+ "country_name": "The Netherlands",
+ "country_code": "NL",
+ "ports_targeted": [
+  49226,
+  10800,
+  58989,
+  1918,
+  69,
+  53000,
+  2086,
+  64,
+  1036,
+  2067,
+  2081,
+  60001,
+  161,
+  1994,
+  1008,
+  31276,
+  38080,
+  32926,
+  32764,
+  32626,
+  31457,
+  31434,
+  31433,
+  33142,
+  31280,
+  32946,
+  31223,
+  31220,
+  31054,
+  31046,
+  31033,
+  31021,
+  30979,
+  26312,
+  30750,
+  30501,
+  31281,
+  30226,
+  33333,
+  33761,
+  34564,
+  34599,
+  35000,
+  35452,
+  35554,
+  35561,
+  37364,
+  37647,
+  37890,
+  32768
+ ],
+ "ports_targeted_count": 524,
+ "tls_event_count": 0,
+ "top_http_methods": [
+  "GET"
+ ],
+ "top_user_agents": [
+  "Go-http-client/1.1"
+ ],
+ "top_url_paths": [
+  "http://azenv.net/"
+ ],
+ "top_ja4_fingerprints": [],
+ "top_ja3_fingerprints": [],
+ "top_hassh_fingerprints": [],
+ "client_cert_event_count": 0,
+ "client_cert_subjects": [],
+ "rdns": "204.76.203.7.ptr.pfcloud.network",
+ "loader_hits": 0,
+ "exploit_hits": 0,
+ "bytes_sent": 197734,
+ "unique_source_ips": 1,
+ "ioc": "204.76.203.7",
+ "window": "all retained data (no time filter)",
+ "query_type": "ip",
+ "scanner": null,
+ "verdict_key": "scanning",
+ "verdict": "Unrecognized scanner",
+ "verdict_why": [
+  "No exploit payloads observed.",
+  "Swept 524 distinct ports (threshold for a sweep is 10).",
+  "Not in any known-scanner range."
+ ],
+ "verdict_confidence": "medium",
+ "cve_probes": []
+}
\ No newline at end of file
-- 
cgit v1.2.3